yajl: heap-based buffer overflow when handling large inputs due to an integer overflow

A flaw was found in the YAJL library in the way it reallocates a memory buffer to store more data. A very large input causes the value used to calculate the buffer size to overflow, resulting in a heap-based buffer overflow...

Use-After-Free

gtkwave is vulnerable to Use-After-Free. The vulnerability is due to improper handling of memory reallocation in the VCD getvartoken function when triggered via the vcd2vzt conversion utility. It allows a specially crafted .vcd file can lead to arbitrary code execution...

Use-After-Free

gtkwave is vulnerable to Use-After-Free. The vulnerability is due to improper handling of memory reallocation in the VCD getvartoken function when triggered via the GUI's interactive VCD parsing code. It allows a specially crafted .vcd file can lead to arbitrary code execution...

Out-of-Bounds-Read

gtkwave is vulnerable to Out-of-Bounds-Read. The vulnerability is due to improper handling of memory reallocation in the VCD var definition section functionality via the vcd2lxt conversion utility. It allows a specially crafted .vcd file can lead to arbitrary code execution...

Out-of-bounds Write

gtkwave is vulnerable to Out-of-bounds Write. The vulnerability is due to improper handling of memory reallocation in the VCD parsevaluechange portdump functionality via the GUI's interactive VCD parsing code, allows specially crafted .vcd file can lead to arbitrary code execution...

UBUNTU-CVE-2024-26618

In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Always exit smealloc early with existing storage When smealloc is called with existing storage and we are not flushing we will always allocate new storage, both leaking the existing storage and corrupting the state. Fi...

The vulnerability of the v4l2_async_unregister_subdev() function in the drivers/media/v4l2-core/v4l2-async.c file of the Linux kernel’s video subsystem driver allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the v4l2asyncunregistersubdev function in the drivers/media/v4l2-core/v4l2-async.c file of the Linux kernel’s video subsystem driver is related to the reallocation of memory. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility o...

USN-6629-3 ujson vulnerabilities

USN-6629-1 fixed vulnerabilities in UltraJSON. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: It was discovered that UltraJSON incorrectly handled certain input with a large amount of indentation. An attacker could possibly use this issue to crash...

The vulnerability of the `nft_setelem_catchall_deactivate()` function in the `net/netfilter/nf_tables_api.c` module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information, thereby enhancing their privileges.

The vulnerability of the nftsetelemcatchalldeactivate function in the net/netfilter/nftablesapi.c module of the Linux operating system is related to the reallocation of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2024-8440 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The vulnerability is related to errors in memory deallocation in the wilc1000 component of the Linux kernel. This issue can cause a denial of service. The problem arises from the...

The vulnerability of the bt_sock_recvmsg() function in the net/bluetooth/af_bluetooth.c module of the Linux kernel’s Bluetooth driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the btsockrecvmsg function in the net/bluetooth/afbluetooth.c module of the Linux kernel’s Bluetooth driver is related to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the gsm_cleanup_mux() function in the N_GSM driver for Linux operating systems allows attackers to increase their privileges.

The vulnerability of the gsmcleanupmux function in the NGSM driver for Linux operating systems is related to the reallocation of previously released memory due to competitive access to resources a “race condition”. Exploiting this vulnerability can allow an attacker to increase their privileges...

kernel: bpf, verifier: Fix memory leak in array reallocation for stack state

A flaw was found in the eBPF subsystem in the Linux kernel. An incorrect logic in a helper function for memory reallocation can cause memory leaks when a memory allocation error occurs, potentially leading to system instability and a denial of service...

mail-internals use-after-free vulnerability in `vec_insert_bytes`

Incorrect reallocation logic in the function vecinsertbytes causes a use-after-free. This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally. The mail-\ suite is unmaintained and the upstream sources have...

RUSTSEC-2023-0054 Use-after-free in `vec_insert_bytes`

Incorrect reallocation logic in the function vecinsertbytes causes a use-after-free. This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally. The mail-\ suite is unmaintained and the upstream sources have...

kernel: i40e: Fix DMA mappings leak

A DMA mapping leak vulnerability was found in the Intel i40e network driver in the Linux kernel. During reallocation of RX buffers when changing ring parameters via ethtool, DMA mappings are not properly cleaned up before creating new ones. Repeated ring size changes can exhaust DMA resources,...

SUSE CVE-2012-5625

OpenStack Compute Nova Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume PV content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume L...

SUSE CVE-2013-1723

The NativeKey widget in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener, which allows remote attackers to cause a denial of service application crash by leveraging incorrect event usage after...

SUSE CVE-2019-20007

An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxmlstr2utf8, while parsing a crafted XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer in some compilers. After this, the function ezxmlparsestr does not check whether the s variable is...

SUSE CVE-2020-26960

If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...