Ubuntu 18.04 LTS / 24.04 LTS : catdoc vulnerabilities (USN-8838-1)

The remote Ubuntu 18.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8838-1 advisory. It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could...

PT-2026-102912

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS affected versions not specified Description A critical pre-authentication integer underflow allows unauthenticated attackers to execute arbitrary code with root privileges. An integer underflow occurs when an arithmetic...

SUSE CVE-2026-93784

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

CVE-2026-97551

A flaw was found in the Linux kernel's XFS file system. A local user can trigger a Denial of Service DoS by forcing an unexpected filesystem shutdown. When updating parent pointer attributes, the kernel fails to properly initialize the block reservation counter, causing an integer underflow durin...

CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-18747

The MCUmgr SMP-over-console transport in the Zephyr RTOS (specifically affecting CONFIG_MCUMGR_TRANSPORT_UART and CONFIG_MCUMGR_TRANSPORT_SHELL) is vulnerable to an integer underflow in mcumgr_serial_process_frag(). The system fails to properly validate declared packet lengths of 0 or 1; when the...

CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math

A flaw was found in the Linux kernel's Soft-iWARP siw component for Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted iWARP Fast Path Data Unit FPDU with a manipulated length field. This manipulation causes an integer underflow, leading to a use-after-free...

USN-8838-1: catdoc vulnerabilities

It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could possibly use this issue to cause catdoc to crash or execute arbitrary code. CVE-2024-48877 It was discovered that catdoc had an integer overflow when...

USN-8838-1 catdoc vulnerabilities

It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could possibly use this issue to cause catdoc to crash or execute arbitrary code. CVE-2024-48877 It was discovered that catdoc had an integer overflow when...

CVE-2026-93789

A flaw was found in the Linux kernel's iwlwifi driver. This vulnerability allows a local user capable of loading custom firmware to cause a Denial of Service DoS through a system crash. The issue stems from insufficient bounds checking when parsing aligned Type-Length-Value TLV data blocks within...

CVE-2026-94287

A flaw was found in libXpm. An unsigned integer underflow vulnerability exists in the library's write path when processing image data. A local attacker could exploit this issue by convincing a user or application to process a specially crafted file, causing unbounded CPU and memory consumption th...

PT-2026-102413

Name of the Vulnerable Software and Affected Versions MCUmgr affected versions not specified Description An integer underflow exists in the SMP-over-console transport when processing base64 frames. The function mcumgr serial process frag in subsys/mgmt/mcumgr/transport/src/serial util.c...

OESA-2026-4070 strongswan security update

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. Security Fixes: In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted...

OESA-2026-4071 strongswan security update

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. Security Fixes: In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted...

CVE-2026-97991: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

SUSE SLES16 Security Update : liboqs (SUSE-SU-2026:23313-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23313-1 advisory. Changes in liboqs: Updated to 0.16.0: Deprecation notice: - SPHINCS+ was removed in 0.16.0. Security issues: - Fixed uninitialized...

SUSE CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

SUSE CVE-2026-97413

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off causing an integer...