113 matches found
PT-2023-22485 · Unknown +4 · Llvm-Project +4
Name of the Vulnerable Software and Affected Versions: llvm-project affected versions not specified Description: A segmentation fault was discovered in the llvm-project via the component mlir::IROperandmlir::OpOperand. Recommendations: At the moment, there is no information about a newer version...
Access violation near NULL on destination operand eval.c:2603:37 in segmentation fault
Description Access violation near NULL on destination operand eval.c:2603:37 in segmentation fault Proof of Concept Faulting Frame: eval1 @ 0x0000000000d9e9d2: in /root/vim/src/vim Disassembly: 0x0000000000d9e9bd: mov rax,r14 0x0000000000d9e9c0: shr rax,0x3 0x0000000000d9e9c4: mov al,BYTE PTR...
Integer overflow
Failure to validate the integer operand in ASP AMD Secure Processor bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service...
Type confusion
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is 'proto'. This is because t...
Low: Red Hat Bug Fix Advisory: Red Hat OpenShift Jaeger 1.20.2 Operator/Operand Containers
Red Hat OpenShift Jaeger 1.20.2. Release of Red Hat OpenShift Jaeger provides these changes:...
Low: Red Hat Bug Fix Advisory: Red Hat OpenShift Jaeger 1.17.8 Operator/Operand Containers
Red Hat OpenShift Jaeger 1.17.8. Release of Red Hat OpenShift Jaeger provides these changes:...
The vulnerability of the Linux operating system’s kernel, related to the lack of protection for service data, allows attackers to disclose protected information.
The vulnerability of the Linux operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information by emulating instructions such as VMXON, VMCLEAR, VMPTRLD, and VMWRITE with a memory address as an...
NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0054)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by multiple vulnerabilities: - It was discovered that the ghostscript PDF14 compositor did not properly handle the copying of a device. An attacker could possibly exploit thi...
Kernel: KVM: leak of uninitialized stack contents to guest
An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exceptions while emulating instructions like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an operand. It occurs if the operand is a mmio address, as the returned exception object hold...
Kernel: KVM: leak of uninitialized stack contents to guest
An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exceptions while emulating instructions like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an operand. It occurs if the operand is a mmio address, as the returned exception object hold...
kernel security update
kernel - 2.6.18-419.0.0.0.14 - x86/speculation/mds: Conditionally clear CPU buffers on idle entry Thomas Gleixner orabug 29821515 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 - x86/speculation/mds: Call VERW on NMI path when returning to user Patrick Colp orabug 29821515...
Linux - Use-After-Free via race Between modify_ldt() and #BR Exception
Linux - Use-After-Free via race Between modifyldt and BR Exception / When a BR exception is raised because of an MPX bounds violation, Linux parses the faulting instruction and computes the linear address of its memory operand. If the userspace instruction is in 32-bit code, this involves looking...
Unbreakable Enterprise kernel security update
kernel-uek 3.8.13-118.35.1 - Bluetooth: hidp: fix buffer overflow Young Xiao Orabug: 29786787 CVE-2011-1079 CVE-2019-11884 - x86/speculation/mds: Fix verw usage to use memory operand Patrick Colp Orabug: 29791038 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 - x86/speculation/mds:...
ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER...
Ghostscript 9.26 - Pseudo-Operator Remote Code Execution
I noticed ghostscript 9.26 was released, so had a quick look and spotted some errors. For background, this is how you define a subroutine in postscript: /hello hello\n print def That's simple enough, but because a subroutine is just an executable array of commands, you need to mark it as...
Ghostscript 9.26 - Pseudo-Operator Remote Code Execution Exploit
Ghostscript 9.26 - Pseudo-Operator Remote Code Execution Exploit I noticed ghostscript 9.26 was released, so had a quick look and spotted some errors. For background, this is how you define a subroutine in postscript: /hello hello\n print def That's simple enough, but because a subroutine is just...
CVE-2019-6116
It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER...
ghostscript: missing type check in type checker (699659)
It was discovered that the ghostscript .type operator did not properly validate its operands. A specially crafted PostScript document could exploit this to crash ghostscript or, possibly, execute arbitrary code in the context of the ghostscript process...
Unbreakable Enterprise kernel security update
2.6.39-400.302.2 - Revert 'Fix up non-directory creation in SGID directories' Brian Maly Orabug: 28781234 2.6.39-400.302.1 - Fix up non-directory creation in SGID directories Linus Torvalds Orabug: 28459479 CVE-2018-13405 - ALSA: seq: Make ioctls race-free Takashi Iwai Orabug: 28459730...
CVE-2018-16767
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service application crash or possibly have unspecified other impact because of an unspecified "heap-buffer-overflow" condition in FunctionValidationContext::popAndValidateOperand...