inetutils-CVE-2019-0053-Patched-PKGBUILD

inetutils 已经 5 年没有更新了，官方的 Arch 包也是如此。有一个补丁已经发布，解决了 CVE-2019-0053（使用 sprintf 而非 snprintf 导致的缓冲区溢出漏洞），但官方版本遥遥无期。 老实说，使用 telnet 的问题远不止缓冲区漏洞，但这是一个高优先级的紧急问题，花了 10 分钟解决。目前正在等待官方维护者的回复，但在此之前这个仓库可以临时使用。...

CVE-2020-8249

CVE-2020-8249: Buffer Overflow in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely calls a “sprintf” which can result in a buffer overflow. Because the “sprintf” writes the values on the stack, if a big enough string is passed to it, then it...

CVE-2019-12937-ToaruOS

CVE-2019-12937 ToaruOS是一套使用C语言编写的开源计算机操作系统，是一个由伊利诺伊大学计算机科学本科生开发的业余爱好操作系统。ToAruOS可在POSIX和x86架构上运行。ToAruOS的主要功能包括对进程和线程的支持、ELF二进制的支持、运行时加载模块、管道（Pipe）和各种类型的终端设备（TTY）的支持、虚拟文件系统的支持、EXT2文件系统的支持、信号量支持等。 ToaruOS 1.10.9及之前版本中的gsudo的apps/gsudo.c文件存在缓冲区溢出漏洞。攻击者可借助DISPLAY环境变量利用该漏洞将权限提升至root。 ToaruOS 1.10.9项目...

go-without-bounds-cve-2026-67822-stack-overflow-in-tenda-w6-s-wifissidset

CVE-2026-67822 — Desbordamiento de búfer de pila en wifiSSIDset de Tenda W6-S PoC PoC complementario del artículo de Hunt-Benito "GO sin límites: CVE-2026-67822 — Desbordamiento de pila en el manejador de formularioswifiSSIDset de Tenda W6-S". CVE-2026-67822 CVSS 9.8 Crítico, CWE-121 es un...

CVE-2026-89575

A flaw was found in the Linux kernel's device mapper dm-raid1 component. This vulnerability occurs in the buildconstructorstring function, where insufficient space is reserved for a NUL-terminator when formatting a string with sprintf. This oversight can lead to a buffer overflow, potentially...

CVE-2026-89575

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

AZL-100328 CVE-2026-89575 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

CVE-2026-89575

CVE-2026-89575 affects the Linux kernel 's device-mapper RAID1 (dm raid1) subsystem. The vulnerability is a buffer overflow in the build_constructor_string() function, where the code fails to reserve space for the NUL-terminator after the maximum 20 decimal digits of a long long value when callin...

CVE-2026-89575 dm raid1: reserve space for NUL-terminator in build_constructor_string()

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

EUVD-2026-76487

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

CVE-2026-89575 dm raid1: reserve space for NUL-terminator in build_constructor_string()

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are vulnerable to an unauthenticated OS command injection via the sync_server daemon on TCP port 13136 . The root cause is that the daemon interpolates attacker-controlled filename input containing shell metacharacters in...

PT-2026-90291

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build constructor string Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

CVE-2022-36163

CVE-2022-36163 建议描述 在 pdftoroff hovacui 1.1.0 pdf 阅读器中发现了格式字符串漏洞。用户 可以控制 sprintf 的第二个参数，这可能导致 DoS 或信息泄露，从而实施更多攻击。 sprintfcommand, output-postsave, fileno, fileno; 附加信息 这只是一个 DoS PoC： 检测到可写段中的 %n 1 8518 IOT 指令（核心已转储） python3 exploit.py 漏洞类型 其他 格式字符串漏洞。 产品供应商 pdftoroff 受影响产品代码库 hovacui - 1.1.0 受影响组...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

EUVD-2026-70786

MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the...

CVE-2026-85452

MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the...

CVE-2026-85452

MOOS ui-moos (through commit 50b9c6c) contains a buffer overflow in the uMS graphical tool, specifically in ScopeTabPane.cpp and ScopeGrid.cpp. Client and variable names are written into fixed 1024-byte buffers via sprintf without length validation. An attacker who can supply arbitrarily long MOO...