25 matches found
CVE-2026-93801 smb/client: zero-initialize stack-allocated cifs_open_info_data
In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...
EUVD-2026-86188
In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...
CVE-2026-93801
The Linux kernel contains a vulnerability in the smb/client component where the stack-allocated cifs_open_info_data is not zero-initialized. This allows the structure to contain random data , potentially causing fields to have incorrect values if they are not explicitly set later. No specific exp...
PT-2026-97950
In the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clk init data eswin clk register pll and eswin register clkdiv declare a struct clk init data on the stack and only initialize some of its fields parent data respectively parent hws. cl...
PT-2026-98001
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the smb/client component where the stack-allocated cifs open info data is not zero-initialized. This can result in the structure containing random data, potentially...
EUVD-2026-81977
In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to...
CVE-2026-90316
CVE-2026-90316 affects the drm/omap DSI driver in the Linux kernel. The root cause is a Use-After-Free (UAF) risk: the ISR (interrupt service routine) table was copied to allow unregistration of ISRs, but stack-allocated objects passed to those ISRs may be freed if IRQs are unregistered while sti...
CVE-2026-71267
microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...
CVE-2026-64831 FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...
PT-2026-48693
exception struct is a local stack variable, but the code passes its address to the C language as &mut exception struct as mut as mut c void. Then, the returned MetaCallException value is stored here: rust OkSelf exception struct: Arc::newexception struct, value: exception ptr, leak: false, Becaus...
PT-2025-44069
Name of the Vulnerable Software and Affected Versions IBM DB2 High Performance Unload versions 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 Description An authenticated user can cause the program to crash due to a buffer overflow when a buffer is allocated on the stack...
CVE-2023-53387
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix device management cmd timeout flow In the UFS error handling flow, the host will send a device management cmd NOP OUT to the device for link recovery. If this cmd times out and clearing the doorbell fails,...
CVE-2023-53387 scsi: ufs: core: Fix device management cmd timeout flow
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix device management cmd timeout flow In the UFS error handling flow, the host will send a device management cmd NOP OUT to the device for link recovery. If this cmd times out and clearing the doorbell fails,...
SUSE CVE-2024-50163
In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpfredirect flags don't overlap The bpfredirectinfo is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri-flags field specifically,...
Use After Free
libvirt is vulnerable to Use After Free. The vulnerability is due to a race condition in the virNetClientIOEventLoop method, where the data pointer to a stack-allocated structure is used after the stack frame is freed. If libvirt is configured with fine-grained access control, an attacker could...
BIT-PHP-2020-7065 mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...
Remote Code Execution (RCE)
PHP is vulnerable to remote code execution RCE. While using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...
CVE-2020-7065
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...
CVE-2020-7065
Removed by vendor...
Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform
https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cppL743 case GetByVal: ... unsigned numberOfArgumentsToSkip = 0; if candidate-op == PhantomCreateRest numberOfArgumentsToSkip = candidate-numberOfArgumentsToSkip;...