49 matches found
UBUNTU-CVE-2026-64445
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...
UBUNTU-CVE-2026-64440
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...
SUSE CVE-2026-64445
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...
EUVD-2026-48790
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use: memcpypadapter-securitypriv.supplicantie, &pwpa0, wpaielen + 2; wher...
CVE-2026-64446 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use: memcpypadapter-securitypriv.supplicantie, &pwpa0, wpaielen + 2; wher...
CVE-2026-64440
CVE-2026-64440 (Linux kernel) : The vulnerability affects the rtl8723bs HT_capabilities handling in staging. HT_caps_handler() reads pIE->length bytes and writes into a fixed 26-byte HT_cap[]; since pIE->length is from an unvalidated 802.11 AssocResponse, an AP can set it to 255, causing up...
Linux Distros Unpatched Vulnerability : CVE-2026-64440
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof...
CVE-2026-53178
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
UBUNTU-CVE-2026-53178
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
EUVD-2026-39270
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix buffer over-read in rtwupdateprotection rtwupdateprotection is called with a pointer offset into the ies buffer but the full ielength is passed, causing a potential buffer over-read...
EUVD-2026-39269
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
CVE-2026-53178 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
CVE-2026-53178
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
CVE-2026-53178
CVE-2026-53178 is a Linux kernel issue in the rtl8723bs Wi‑Fi driver (rtw_mlme) where an unsigned underflow can occur when subtracting fixed IE offsets from ie_length. The available connected sources indicate the bug has been fixed in the kernel (staging) by adding bounds checks to ensure ie_leng...
Morse Micro HaLowLink 安全漏洞
Morse Micro HaLowLink is a series of long-range wireless gateway devices developed by Morse Micro Corporation. Versions of Morse Micro HaLowLink prior to 2.2.11.13 contained security vulnerabilities. These vulnerabilities stemmed from the use of the IE length field as the size parameter for the...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003521)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003521 advisory. In the function wmisetie, the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ielen' argument can cause...
PT-2025-51669
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel related to the rtl8723bs driver. The rtw get ie parser does not properly validate the length of Information Element IE data within network frames...
EUVD-2018-3945
Malware in sbrugna...