110733 matches found
CVE-2026-101341
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
EUVD-2026-100985
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341
The NSD name server is vulnerable to an out-of-bound stack write due to insufficient bounds checking on text tokens in RDATA (e.g., TXT records ) under 32 bytes. This flaw allows for arbitrary sized writes , including the potential overwrite of a callback function pointer immediately following a ...
CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
CVE-2026-88842
A flaw exists in the BusyBox dpkg utility where the write_status_file() function fails to reset a field cursor between package stanzas. This results in an out-of-bounds read and leads to limited data corruption when two packages are removed in a single invocation, specifically if the first stanza...
CLSA-2026-1791970059 Fix CVE(s): CVE-2026-44185, CVE-2026-46729
SECURITY UPDATE: buffer over-read in modssl OCSP requests - debian/patches/CVE-2026-44185.patch: in sendrequest in modules/ssl/sslutilocsp.c, advance the write pointer by the number of bytes actually sent instead of the total remaining length so a short write to an attacker controlled OCSP...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
SUSE CVE-2026-109774
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...
SUSE CVE-2026-109939
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...
SUSE CVE-2026-109942
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...
CLEANSTART-2026-AW54211 crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo
Security vulnerability affects the libjpeg-turbo package. A crafted input file could cause a null pointer dereference in jcopysamplerows when processed by libjpeg-turbo...
EUVD-2026-100748
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a...
EUVD-2026-100749
Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS7 blob with SECPKCS7ContainsCertsOrCrls and then iterates the certificate list with...
github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter
A flaw was found in kin-openapi's openapi3filter module. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by crashing the application. The issue occurs when processing OpenAPI 3.1 array schemas that lack an items definition, causing the parser to...