CVE-2022-23967

CVE-2022-23967 TightVNC 1.3.10에는 rfbproto.c의 InitialiseRFBConnection에 정수 부호 오류와 그로 인한 힙 기반 버퍼 오버플로가 있습니다vncviewer 구성 요소의 경우. malloc에 전달되는 크기에 대한 검사가 없습니다예: -1이 허용됨. 이로 인해 크기가 0인 청크가 할당되어 힙 포인터가 생성됩니다. 그러나 0xffffffff 바이트의 데이터를 보낼 수 있으며, 이는 DoS 영향 또는 원격 코드 실행으로 이어질 수 있습니다. 취약점 유형 버퍼 오버플로 제품 공급업체...

CVE-2017-7308

CVE-2017-7308 CVE ID: CVE-2017-7308 발행일: 2017-03-29T20:59:00.373 기본 점수CVSS 3.0/3.1: 7.8 설명: Linux 커널 4.10.6까지의 net/packet/afpacket.c에 있는 packetsetring 함수는 특정 블록 크기 데이터를 제대로 검증하지 않아, 로컬 사용자가 조작된 시스템 호출을 통해 서비스 거부정수 부호 오류 및 경계를 벗어난 쓰기를 유발하거나 CAPNETRAW 기능을 보유한 경우 권한을 획득할 수 있습니다...

CVE-2018-12018

CVE-2018-12018 Mitre https://vulners.com/cve/CVE-2018-12018 Go Ethereum일명 geth 1.8.11 이전 버전의 LES 프로토콜 구현에 있는 GetBlockHeadersMsg 핸들러는 배열 인덱스에 대한 정수 부호 오류로 인해 액세스 위반을 초래할 수 있으며, 공격자는 -1 query.Skip 값이 포함된 패킷을 전송하여 서비스 거부DoS 공격을 실행할 수 있습니다. 이러한 공격은 취약한 원격 노드를 즉시 충돌시키며, EPoDEthereum Packet of Death 문제...

CVE-2013-2028_Checker

CVE-2013-2028 - Nginx HTTP Server 1.3.9-1.4.0 청크 인코딩 스택 버퍼 오버플로우 설명 nginx 1.3.91.4.0의 http/ngxhttpparse.c에 있는 ngxhttpparsechunked 함수는 원격 공격자가 큰 청크 크기의 chunked Transfer-Encoding 요청을 통해 서비스 거부크래시 및 임의 코드 실행을 유발할 수 있게 하며, 이는 정수 부호 오류 및 스택 기반 버퍼 오버플로우를 트리거합니다. 예시 $ python3 nginxcve20132028checker.py...

CVE-2026-97990

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

Astra Linux – Vulnerability in u-boot

In Das U-Boot through 2022.07-rc5, an integer signedness error and resulting stack-based buffer overflow occur in the “i2c md” command, which allows for the corruption of the return address pointer of the doi2cmd function...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the net/ceph/messengerv2.c file within the Linux kernel before version 6.4.5. There is an integer signedness error, which leads to a buffer overflow and remote code execution via the HELLO command or one of the AUTH frames. This occurs due to an untrusted length value...

lighttpd 2.0.0 Out-Of-Bounds Access

A signedness vulnerability exists in the lichunkqueueappendmem function in lighttpd2, where a signed length parameter gssize len is not properly validated before being used in memory operations that expect an unsigned size. When a negative length value is supplied, it is implicitly converted to a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093165)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093165 advisory. Integer signedness error in the pnginflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allo...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the signedness bug in sdmav40processtrapirq The “instance” variable needs to be signed for error handling to work properly...

CVE-2026-74679: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

Linux Distros Unpatched Vulnerability : CVE-2026-72300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition...

CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72380 xen/pvcalls: bound backend response req_id before indexing rsp[]

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72300: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-11743: Out-of-bounds Read

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

ANT-2026-M8R2AWBV · linux · other

other high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-M8R2AWBV: ksmbd SMB-Direct: pre-auth remote heap overflow via preferredsendsize signedness mintint Pre-auth remot...

Updated perl-Imager package fixes security vulnerabilities

The updated package fixes security vulnerabilities: The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim method is called on a crafted input image. CVE-2024-53901 Imager versions before 1.032 fo...

CVE-2026-51536

In OpENer 2.3.0 commit 76b95cf when parsing incoming CIP Common Industrial Protocol network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 a 16-bit signe...

CVE-2026-14454 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. ...