536 matches found
AlmaLinux 9.2 [TuxCare] Security Update: libslirp / libslirp-devel (ALMALINUX9.2:CLSA-2026:1794351548)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794351548 advisory. - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small...
AlmaLinux 9.6 [TuxCare] Security Update: libslirp / libslirp-devel (ALMALINUX9.6:CLSA-2026:1794351730)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794351730 advisory. - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small...
Rocky Linux 9.6 [TuxCare] Security Update: libslirp / libslirp-devel (ALMALINUX9.6:CLSA-2026:1794351730)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794351730 advisory. - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small...
vbox-ovf-nat-tftp-prefix
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vbox-ovf-nat-tftp-prefix Write-up: https://abraxaslabs.tech/research/virtualbox-7-2-20-leftovers vbox-ovf-nat-tftp-prefix Class: File read Reach: Local guest after UI:R import Oracle VM VirtualBox OSS 7.2.20 f2792cf44...
CVE-2026-115449 affecting package libslirp for versions less than 4.9.6-1
CVE-2026-115449 affecting package libslirp for versions less than 4.9.6-1. An upgraded version of the package is available that resolves this issue...
SUSE CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...
SUSE CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...
DEBIAN-CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw exists in libslirp within the if_output() function. When a session moves from the fast queue to the batch queue, the code incorrectly unlinks and reinserts an arbitrary packet via ifm->m_nextpkt instead of the session queue head. This leads to queue pointer corruption . A guest generati...
CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
EUVD-2026-115656
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
DEBIAN-CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...
CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...