DEBIAN-CVE-2024-56627

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Read in ksmbdvfsstreamread An offset from client could be a negative value, It could lead to an out-of-bounds read from the streambuf. Note that this issue is coming when setting 'vfs objects = streamsxat...

DEBIAN-CVE-2024-56616

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC aka message data CRC at the end of the message. This fixes a...

CVE-2024-56627 ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Read in ksmbdvfsstreamread An offset from client could be a negative value, It could lead to an out-of-bounds read from the streambuf. Note that this issue is coming when setting 'vfs objects = streamsxat...

[SECURITY] Fedora 41 Update: libxml2-2.12.9-1.fc41

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

PT-2024-10378

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an out-of-bounds read in ksmbd vfs stream read. It occurs when a client's offset is a negative value, leading to an out-of-bounds read from stream buf. This probl...

CLSA-2024-1735065830 Fix CVE(s): CVE-2024-11233

SECURITY UPDATE: Security vulnerability in package - debian/patches/CVE-2024-11233.patch: fix error in convert.quoted printable-decode filter certain data leading to buffer overread. Fix segfault with streams and invalid data. - CVE-2024-11233...

CLSA-2024-1735064231 Fix CVE(s): CVE-2024-11234

SECURITY UPDATE: Security vulnerability - debian/patches/CVE-2024-11234.patch: Fix stream HTTP fulluri CRLF injection issue - CVE-2024-11234...

Freedesktop Poppler security vulnerability

Freedesktop Poppler is a Freedesktop community C++ class library for generating PDFs, which is inherited from Xpdf PDF reader. A security vulnerability exists in Freedesktop Poppler version 24.12.0 and earlier versions, which stems from an out-of-bounds read vulnerability in libpoppler.so in the...

Important: xstream

Issue Overview: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream. XStream provides a BinaryStreamDriver with an own optimized serialization format. The format uses ids for string values as deduplication. The mapping for these ids are...

sctp: properly validate chunk size in sctp_sf_ootb()

...

sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start

...

DEBIAN-CVE-2024-47602

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. This function does not properly check the validity of the stream-codecpriv pointer in th...

PT-2024-29259 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow affected versions not specified Description: A flaw was found in Undertow, where an HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2...

UBUNTU-CVE-2024-47602

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. This function does not properly check the validity of the stream-codecpriv pointer in th...

PT-2024-10008

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 7.0.8 Description The issue is related to a buffer overflow in the Suricata system, which can be caused by a specially crafted TCP stream. This can lead to a very large buffer overflow while being zero-filled during...

CVE-2024-47537: Out-of-bounds Write

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-samples to accommodate stream-nsamples + samplescount elements of type QtDemuxSample. The problem is that samplescount is read from the input file. And i...

CVE-2024-47597

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemuxparsesamples within qtdemux.c. This issue arises when the function qtdemuxparsesamples reads data beyond the boundaries of the stream-stco buffer. The following code...

Configuring a proxy in a stream context might allow for CRLF injection in URIs

...

pdfbox:PDFStreamParserFuzzer: Security exception in java.base/java.util.stream.ReferencePipeline$7$1.accept

Detailed Report: https://oss-fuzz.com/testcase?key=5718027917656064 Project: pdfbox Fuzzing Engine: libFuzzer Fuzz Target: PDFStreamParserFuzzer Job Type: libfuzzerasanpdfbox Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

itext7:PdfFuzzer: Security exception in com.itextpdf.kernel.pdf.PdfReader.readStreamBytesRaw

Detailed Report: https://oss-fuzz.com/testcase?key=5253687070490624 Project: itext7 Fuzzing Engine: libFuzzer Fuzz Target: PdfFuzzer Job Type: libfuzzerasanitext7 Platform Id: linux Crash Type: Security exception Crash Address: Crash State: com.itextpdf.kernel.pdf.PdfReader.readStreamBytesRaw...