9174 matches found
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989403)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989403 advisory. In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemacliteofprobe This node pointer is returned by ofparsephandle...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989996)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989996 advisory. In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacyparseparam The usual LSM hook bail on fail scheme doesn't...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989026)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989026 advisory. In the Linux kernel, the following vulnerability has been resolved: watchdog: ts4800wdt: Fix refcount leak in ts4800wdtprobe ofparsephandle returns a node pointer wi...
MGASA-2025-0256 Updated golang packages fix security vulnerabilities
Insufficient validation of bracketed IPv6 hostnames in net/url. CVE-2025-47912 Unbounded allocation when parsing GNU sparse map in archive/tar. CVE-2025-58183 Parsing DER payload can cause memory exhaustion in encoding/asn1. CVE-2025-58185 Lack of limit when parsing cookies can cause memory...
PT-2025-46926
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457106694 Crash type: Stack-buffer-overflow READ 8 Crash state: snmp input snmp parse trap fuzzer.c...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: ceph parselongname: strrchr expects a NUL-terminated string … And parselongname does not guarantee this. That’s why it uses kmemdupnul to create an NUL-terminated string for the argument passed to kstrtou64; The problem is that...
Eval Injection
Overview litdb is an A literature database tool with GPT integration. Affected versions of this package are vulnerable to Eval Injection via the parseschemadsl function in the extract.py file, which unsafely uses the eval function. This allows an attacker to execute arbitrary Python code on the...
ksmbd: fix out-of-bounds in parse_sec_desc()
...
CLSA-2025-1761902260 Fix CVE(s): CVE-2024-45490
SECURITY UPDATE: Improper restriction of XML External Entity Reference - debian/patches/CVE-2024-45490.patch: Reject negative len for XMLParseBuffer - CVE-2024-45490...
Linux kernel USB Device DoS
The vulnerability of the usbparsessendpointcompanion function in the drivers/usb/core/config.c file of the Linux device support driver module is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
CLSA-2025-1761847256 Fix CVE(s): CVE-2022-47673, CVE-2023-25584
SECURITY UPDATE: multiple vulnerabilities in vms-alpha.c parsemodule - debian/patches/CVE-2022-47673CVE-2023-25584-.patch: fix null pointer dereference in parsemodule by adding return value checking for bfdzalloc calls, fix potential out of bounds memory access in DST record parsing loop -...
CVE-2025-40099
In the Linux kernel, the following vulnerability has been resolved: cifs: parsedfsreferrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTLDFSGETREFERRALS - reply smaller than sizeofstruct getdfsreferralrsp - reply with number of referrals smaller than...
EUVD-2025-36739
The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...
EUVD-2025-36735
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...
AZL-69290 CVE-2025-61725 affecting package golang 1.25.12-1
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...
CVE-2025-61725
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...
AZL-78905 CVE-2025-47912 affecting package golang 1.25.7-1
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...
UBUNTU-CVE-2025-61725
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...
CVE-2025-47912 Insufficient validation of bracketed IPv6 hostnames in net/url
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...
CVE-2025-47912 Insufficient validation of bracketed IPv6 hostnames in net/url
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...