CVE-2023-20032

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code...

Cisco Releases Security Advisories for Multiple Products

Cisco has released security advisories for vulnerabilities affecting multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA...

FreeBSD : clamav -- Multiple vulnerabilities (fd792048-ad91-11ed-a879-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fd792048-ad91-11ed-a879-080027f5fec9 advisory. - On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A...

ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code...

SUSE CVE-2005-3109

The HFS and HFS+ hfsplus modules in Linux 2.6 allow attackers to cause a denial of service oops by using hfsplus to mount a filesystem that is not hfsplus...

SUSE CVE-2006-6056

Linux kernel 2.6.x up to 2.6.18 and possibly other versions, when SELinux hooks are enabled, allows local users to cause a denial of service crash via a malformed file stream that triggers a NULL pointer dereference in the superblockdoinit function, as demonstrated using an HFS filesystem image...

SUSE CVE-2008-5025

Stack-based buffer overflow in the hfscatfindbrec function in fs/hfs/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service memory corruption or system crash via an hfs filesystem image with an invalid catalog namelength field, a related issue to CVE-2008-49...

SUSE CVE-2009-4020

Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a crafted Hierarchical File System HFS filesystem, related to the hfsreaddir function in fs/hfs/dir.c...

SUSE CVE-2011-2203

The hfsfindinit function in the Linux kernel 2.6 allows local users to cause a denial of service NULL pointer dereference and Oops by mounting an HFS file system with a malformed MDB extent record...

SUSE CVE-2011-4330

Stack-based buffer overflow in the hfsmac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service crash and possibly execute arbitrary code via an HFS image with a crafted len field...

SUSE CVE-2016-2334

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image...

SUSE CVE-2018-12928

In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfsextreadextent in hfs.ko. This can occur during a mount of a crafted hfs filesystem...

SUSE CVE-2018-19497

In The Sleuth Kit TSK through 4.6.4, hfscattraverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service SEGV on unknown address with READ memory access in a tskgetu16 call in hfsdiropenmetacb in tsk/fs/hfsdent.c...

SUSE CVE-2019-1010065

The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfsdent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfscattraverse in lines: 952, 1062. The attack...

clamav -- Multiple vulnerabilities

Simon Scannell reports: CVE-2023-20032 Fixed a possible remote code execution vulnerability in the HFS+ file parser. CVE-2023-20052 Fixed a possible remote information leak vulnerability in the DMG file parser...

PT-2025-49753

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 Description The Linux kernel contains a flaw within the hfs module related to reference counting of hfs bnode structures. Specifically, a missing call to hfs bnode get afte...

GSD-2023-1001566 hfs: fix OOB Read in __hfs_brec_find

hfs: fix OOB Read in hfsbrecfind This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit 8c40f2dbae603ef0bd21e87c63f54ec59fd88256. Fo...

GSD-2023-1001490 hfs: Fix OOB Write in hfs_asc2mac

hfs: Fix OOB Write in hfsasc2mac This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit cff9fefdfbf5744afbb6d70bff2b49ec2065d23d, i...

GSD-2023-1001348 hfs: fix OOB Read in __hfs_brec_find

hfs: fix OOB Read in hfsbrecfind This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit 4fd3a11804c8877ff11fec59c5c53f1635331e3e. F...

GSD-2023-1001236 hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling

hfs/hfsplus: avoid WARNON for sanity check, use proper error handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...