CVE-2024-26160

CVE-2024-26160 ثغرة كشف معلومات في cldflt.sys هناك شرح مختصر حول CVE-2024-26160 ، والذي يمكن العثور عليه في تصحيح فبراير KB5034765 ، ويندوز 11 22H2، ويندوز 11 23H2. تم إصلاح الثغرة في تصحيح مارس KB5035853. التحليل تقع الثغرة في الدالة CldiPortProcessGetRangeInfo، حيث أنها لا تتحقق من حجم المخزن...

ABL_ROP

تحديث الرقم التسلسلي لـ ABL باستخدام ROP: عند تشغيل هذا الدفتر، سيتم تحميل ABL ومحاولة تحديث الرقم التسلسلي للجهاز عبر سلسلة ROP لاستدعاء memmove. مشتق من https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb لـ eShard مع متابعة https://eshard.com/posts/pixel6bootloader المخرجات...

CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: تخصيص ناقص للمخزن المؤقت المصدر في مسار CopyPixels يؤدي إلى قراءة خارج الحدود وانتهاك الوصول رفض الخدمة عند فك تشفير صورة HEIF مصممة عبر WIC، يقوم برنامج الترميز msheif بتخصيص مخزن مؤقت مصدر بحجم 1 بايت لكنه يحاول لاحقًا نسخ كمية كبيرة جدًا من بيان...

cve-2024-46483

CVE-2024-46483 - تجاوز سعة الكومة قبل المصادقة في خادم Xlight SFTP الإصدارات المتأثرة إصدارات Xlight 32 و64 بت = 3.9.4.2 التأثير يمكن لمهاجم غير مصادق لديه وصول إلى Xlight SFTP أن يحصل على تنفيذ كود أو يتسبب في رفض الخدمة. السبب الجذري السلاسل المرسلة عبر الشبكة في بروتوكول SFTP تكون مسبوقة بطول...

CVE-2021-21551

CVE-2021-21551 إثبات مفهوم لاستغلال الثغرة CVE-2021-21551، تنشأ الثغرة من توفير عناوين يقدمها المستخدم كوسائط لاستدعاء memmove مما يسمح بقراءة/كتابة عشوائية ioctls 0x9B0C1EC4 و 0x9B0C1EC8 بالإضافة إلى معامل العنوان الفعلي لاستدعاء MmMapIoSpace الذي يوفر قراءة/كتابة عشوائية أخرى ioctls 0x9B0C1F40 ...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 Élévation de privilèges locale sous FreeBSD viaexecargsadjustargs memmove hors limites Un bug de précédence d'opérateur dans execargsadjustargs sys/kern/kernexec.c, présent depuis 2013 permet à tout...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: kobjectuevent: Fixed issues related to OOB access within zapmodaliasenv. The zapmodaliasenv function incorrectly calculates the size of the memory block to be moved. This can lead to OOB out-of-band memory access issues if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “vt: fix unicode buffer corruption when deleting characters” This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 “vt: fix memory overlapping when deleting chars in the buffer”. The solution is als...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The bound NTFSDEdeview.dataoff was bound in UpdateRecordDataRoot,Allocation. In the UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 functions, the destination of the memmove operation is...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – Analyse de TIFFReadRGBATileExt dans libtiff Vue d'ensemble Ce laboratoire analyse la CVE-2023-52356 dans libtiff, en se concentrant sur le comportement de TIFFReadRGBATileExt lorsqu'il reçoit des coordonnées d'image en dehors des limites valides de l'image. L'analyse comprend la...

Rocky Linux 8 [CIQ] Security Update: lz4 / lz4-debuginfo / lz4-debugsource / lz4-devel / lz4-libs / etc (crlsa-2021_2575)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212575 advisory. lz4: memory corruption due to an integer overflow bug caused by memmove argument CVE-2021-3520 Tenable has extracted the preceding description block directly from t...

ANT-2026-QT406EDT · LibreOffice/core · Memory corruption (heap buffer overflow)

other medium CVE-2026-63274 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-QT406EDT: Heap overflow from unclamped /Length...

SUSE CVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

CVE-2026-19499

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can cause an integer overflow in the memmove function, resulting in a heap-based buffer overflow in the ntfsattrrecordresize function, as of NTFS-3G version 2021.8.22...

Astra Linux – Vulnerability in lz4

There is a flaw in lz4. An attacker who submits a crafted file to an application that uses lz4 may be able to trigger an integer overflow, resulting in the call to memmove with a negative size argument. This can lead to an out-of-bounds write and/or a system crash. The most significant impact of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105tabledeleteentry There are actually 2 problems: 1. Deleting the last element does not require moving elements. In fact, the element at position i+1 is out of bounds. 2...

Astra Linux – Vulnerability in liblivemedia

In Live555 0.95, there is a buffer overflow due to a large integer in the Content-Length HTTP header. This occurs because the handleRequestBytes function uses a memmove operation without proper bounds...