743 matches found
AZL-89772 CVE-2026-52859 affecting package vim for versions less than 9.2.0620-1
Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars array with no upper bound, stopping only...
Updated jq packages fix security vulnerabilities
An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...
MGASA-2026-0188 Updated jq packages fix security vulnerabilities
An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...
TencentOS Server 4: php (TSSA-2026:0342)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0342 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2025-14179
A flaw was found in PHP. The PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat, which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens...
CVE-2026-23863
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of...
Security update for jq
This update for jq fixes the following issue CVE-2026-33948: CLI input parsing may allow validation bypass via embedded NUL bytes bsc1262043 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...
net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...
net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...
net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...
net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...
net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...
SUSE-SU-2026:2092-1 Security update for go1.26-openssl
This update for go1.26-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...
SUSE-SU-2026:2079-1 Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...
CVE-2026-6104
A flaw was found in PHP. When an encoding name containing an embedded NUL byte is passed to mbconvertencoding or related mbstring functions, an out-of-bounds read of only 1 byte can occur due to the incorrect processing of string lengths. This issue can cause a denial of service or limited...
gnutls: gnutls: Authentication Bypass via NUL Character in Username
A flaw was found in gnutls. Servers configured with RSA-PSK Rivest–Shamir–Adleman – Pre-Shared Key wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass...
CLSA-2026-1779462193 Fix CVE(s): CVE-2026-33515
SECURITY UPDATE: out-of-bounds read when handling malformed ICP traffic - debian/patches/CVE-2026-33515.patch: validate ICP packet sizes and URLs in icpGetUrl; reject non-NUL-terminated URLs, URLs with embedded NULs or trailing garbage; guard icpHandleUdp against a nil icpOutgoingConn pointer -...
OESA-2026-2425 jq security update
jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want. Security Fixes: jq is ...
CLSA-2026-1779272835 gnutls: Fix of CVE-2026-42010
CVE-2026-42010: fix RSA-PSK identity truncation allowing authentication bypass via NUL byte in client-supplied username...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ice: Ensure that the copied buffer is terminated with NUL characters. Currently, we allocate a kernel buffer of a certain size and copy a certain number of bytes from user space to that buffer. Later, we use sscanf on this buffer...