40 matches found
Uninitialized memory exposed when streaming decompression of a legacy frame fails
When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompressstream committed that position even on error, and for a Vec destination this extended the vector's length over...
Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...
PT-2026-125062
When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompress stream committed that position even on error, and for a Vec destination this extended the vector's length over...
PT-2026-125051
From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...
Astra Linux – vulnerability in linux-6.1, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbdvfsstreamwrite The offset from the client can be a negative value; this may allow writing data outside the bounds of the allocated buffer...
CVE-2026-38728
An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...
CVE-2026-38728
Nodemailer smtp_server versions prior to v3.18.3 are vulnerable to an unauthenticated memory exhaustion denial-of-service (DoS). The root cause lies in the SMTPStream._write method within the lib/smtp-stream.js component, where the _remainder buffer appends incoming TCP chunks in command mode wit...
PT-2026-41303
Name of the Vulnerable Software and Affected Versions Nodemailer smtp server versions prior to 3.18.3 Description A remote attacker can cause a denial of service through the SMTPStream. write function within the lib/smtp-stream.js component. Recommendations Update to version 3.18.3 or later...
CVE-2026-38728
An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...
EUVD-2022-41354
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-38791
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MariaDB before 10.9.2, compresswrite in extra/mariabackup/dscompress.cc does not release datamutex upon a stream write failure, which allows local users to...
BIT-MARIADB-MIN-2022-38791
In MariaDB before 10.9.2, compresswrite in extra/mariabackup/dscompress.cc does not release datamutex upon a stream write failure, which allows local users to trigger a deadlock...
SUSE CVE-2025-37947
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating pos ksmbdvfsstreamwrite did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than or equal to vle...
DEBIAN-CVE-2025-37947
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating pos ksmbdvfsstreamwrite did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than or equal to vle...
UBUNTU-CVE-2025-37947
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating pos ksmbdvfsstreamwrite did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than or equal to vle...
CVE-2025-37947 ksmbd: prevent out-of-bounds stream writes by validating *pos
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating pos ksmbdvfsstreamwrite did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than or equal to vle...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from ksmbdvfsstreamwrite unverified pos resulting in an out-of-bounds write...
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
...
DEBIAN-CVE-2024-56626
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbdvfsstreamwrite An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs...
PT-2024-10375
Name of the Vulnerable Software and Affected Versions: Linux kernel versions are not explicitly specified in the provided descriptions. Description: The issue is related to an Out-of-Bounds Write in ksmbd vfs stream write. It occurs when an offset from the client is a negative value, allowing dat...