Linux-Heap-Based-Type-Confusion-in-L2CAP

Linux: L2CAP 中基于堆的类型混淆 CVE-2020-12351 Linux: L2CAP 中基于堆的类型混淆 针对 BLE 实现的 PoC CVE-2020-12351 为何修改原始 PoC？ 原始 PoC 专注于通过经典蓝牙发送恶意 l2cap 数据包。然而，我的需求是将其测试于仅支持蓝牙低功耗 BLE 通信且已采用完整 BlueZ 协议栈（经典和低功耗均支持）的外设上。 L2CAP 是主机协议栈中的通用协议，同时支持蓝牙经典和 BLE 实现。 先决条件 配备 BLE 适配器的 Linux 机器。如果机器没有内置适配器，可以购买一个外接适配器。 使用方式：...

EUVD-2026-79134

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the targe...

CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-

Qualys Security Advisory Baron Samedit：Sudo 中的堆缓冲区溢出 CVE-2021-3156 ======================================================================== 目录 概述 分析 利用 致谢 时间线 ======================================================================== 概述 我们在 Sudo https://www.sudo.ws/ 中发现了一个堆缓冲区溢出漏洞。该漏洞：...

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2021-3156-Exp

CVE-2021-3156-Exp CVE-2021-3156 的利用代码。 经过一夜的研究，终于搞定了！ 致谢 https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt...

CVE-2026-91088 GPAC URL url.c gf_url_concatenate_ex heap-based overflow

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

EUVD-2026-78303

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

CVE-2026-91086

GPAC (up to commit f1219cde) contains a heap-based buffer overflow in the function mpgviddmx_process within filters/reframe_mpgvid.c, part of the MPEG Video Reframer component. The vulnerability is exploitable remotely with low complexity and no required privileges, though user interaction is req...

EUVD-2026-78301

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmxprocess of the file filters/reframempgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The...

CVE-2021-3156

CVE-2021-3156 https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit https://access.redhat.com/security/vulnerabilities/RHSB-2021-002...

OESA-2026-3725 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A flaw was found in xdgmime. A heap-base...

CVE-2026-90948

GIMP's ICO file loader is vulnerable to a heap-based buffer overflow triggered by an integer overflow when calculating the buffer size for an embedded PNG image within an ICO file. The undersized allocation causes decoded pixel data to overflow the buffer, potentially enabling arbitrary code exec...

Astra Linux – Vulnerability in ffmpeg

There is a heap-based Buffer Overflow vulnerability in FFmpeg 4.2, located in the file libavfilter/vfvmafmotion.c, within the convolutiony8bit module. This vulnerability could allow a remote malicious user to cause a Denial of Service attack...

Astra Linux – Vulnerability in libwebp

A heap-based buffer overflow was discovered in libwebp in versions prior to 1.0.1 in the GetLE24 function...

CVE-2021-3156

CVE-2021-3156 Ansible角色为CentOS修补CVE-2021-3156 简介 Sudo 1.9.5p2之前版本存在基于堆的缓冲区溢出漏洞，允许通过 "sudoedit -s" 和以单个反斜杠字符结尾的命令行参数将权限提升至 root。 CVE-2021-3156 新闻（俄语） 运行 root@kitploit: ansible-playbook updatessh.yml --tags ssh-update...

CVE-2026-90682

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-90682

A heap-based buffer overflow in the ProcessGpsInfo function of gpsinfo.c (WebP EXIF Handler) affects Matthias-Wandel jhead up to 3.3 . Manipulation of the TAG_GPS_LAT/TAG_GPS_LONG arguments triggers the overflow. The attack vector is local with low privileges required, yielding partial impact on ...

AlmaLinux 8 : glib2 (ALSA-2026:66451)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66451 advisory. xdgmime: heap-based buffer overflow in xdgmimemagicparsemagicline in xdgmimemagic.c CVE-2026-16118 Tenable has extracted the preceding description block directly...