1997 matches found
CVE-2026-94286 Out-of-bounds read in libXtst's RECORD reply parser
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...
CVE-2026-94286
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...
CVE-2026-94286: Buffer Over-read
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...
PT-2026-99820
Name of the Vulnerable Software and Affected Versions libXtst versions prior to 1.2.6 Description An out-of-bounds read occurs in the RECORD reply parser of libXtst. This flaw allows a malicious X server to cause a crash of attached X clients. An out-of-bounds read is a condition where a program...
Linux Distros Unpatched Vulnerability : CVE-2026-93228
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount...
CVE-2026-93228
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...
UBUNTU-CVE-2026-93228
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...
CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-93808
The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...
CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-93228 svcrdma: Reject Write/Reply chunks with segcount 0
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...
CVE-2026-93228
The Linux kernel contains a vulnerability in svcrdma where a peer can send a Write or Reply chunk with a segcount field of zero. The xdr_check_write_chunk() function fails to reject these zero-count chunks because it only checks for values exceeding rc_maxpages. This allows malformed chunks to be...
CVE-2026-93228 svcrdma: Reject Write/Reply chunks with segcount 0
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...
CVE-2026-93228
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...
PT-2026-104946
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdr check write chunk only rejects segcount rc maxpages, so zero passes the range check, and xdr inline...
CVE-2026-93228: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...
CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...
CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...
