112081 matches found
CVE-2026-98404
A vulnerability was identified in the Linux kernel within the drm/virtio component. The function virtio_gpu_user_framebuffer_create() incorrectly returned NULL in certain scenarios, which led to a NULL pointer dereference in drm_mode_addfb2(). The issue has been resolved by ensuring the function ...
CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...
CVE-2026-98400
In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...
CVE-2026-98399
In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...
ALPINE-CVE-2026-101341
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341
The NSD name server is vulnerable to an out-of-bound stack write due to insufficient bounds checking on text tokens in RDATA (e.g., TXT records ) under 32 bytes. This flaw allows for arbitrary sized writes , including the potential overwrite of a callback function pointer immediately following a ...
EUVD-2026-100985
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
CVE-2026-88842
A flaw exists in the BusyBox dpkg utility where the write_status_file() function fails to reset a field cursor between package stanzas. This results in an out-of-bounds read and leads to limited data corruption when two packages are removed in a single invocation, specifically if the first stanza...
CLSA-2026-1791970059 Fix CVE(s): CVE-2026-44185, CVE-2026-46729
SECURITY UPDATE: buffer over-read in modssl OCSP requests - debian/patches/CVE-2026-44185.patch: in sendrequest in modules/ssl/sslutilocsp.c, advance the write pointer by the number of bytes actually sent instead of the total remaining length so a short write to an attacker controlled OCSP...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...
SUSE CVE-2026-109679
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...