CVE-2025-47812

CVE-2025-47812 这是 Wing FTP 服务器漏洞（CVE-2025-47812）的概念验证（PoC） 描述 Wing FTP Server 7.4.4 之前的版本因对用户名参数的不安全处理而存在远程代码执行（RCE ）漏洞。当我们在 /loginok.html 页面登录时，可以注入空字节 %00 后跟 Lua 代码，以实现 RCE。 背景事件 当我们向 loginok.html 页面发送 POST 请求时，cCheckUser 函数（用于验证正确用户名和密码的函数）使用了 strlen。问题在于该依赖函数容易受到空字节截断的影响。 这意味着如果我们在用户名后发送...

AlmaLinux 9.2 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778142360)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778142360 advisory. - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jvsetpath, jvgetpath, and delpathssorted in jq's...

Linux Distros Unpatched Vulnerability : CVE-2026-88832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

Linux Distros Unpatched Vulnerability : CVE-2026-93234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and require...

CVE-2026-93234

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-93234 drm/gud: validate TV mode names before creating enum property

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-89817

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

CVE-2026-89817 drm/gud: NUL-terminate TV mode names read from the device

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

CVE-2026-89817 drm/gud: NUL-terminate TV mode names read from the device

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

CVE-2026-89817

CVE-2026-89817 affects the Linux kernel DRM/GUD driver. The function gud_connector_add_tv_mode() reads fixed-size TV mode name buffers from a USB device and passes pointers to drm_mode_create_tv_properties_legacy(), which calls strlen() on each name. Because the device does not guarantee NUL-term...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Mounting fails due to a buffer overflow in strlen. Starting with kernel 5.11, when building with CONFIGFORTIFYSOURCE, mounting an ocfs2 filesystem using either o2cb or pcmk cluster stack will fail. The issue seems to be th...

Astra Linux – Vulnerability in jq

jq is a command-line JSON processor. Commits prior to 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen to determine buffer length instead of the actual by...

Updated perl-Imager packages fix a security vulnerability

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags...

SUSE CVE-2026-74399

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evmxattrs read buffer evmreadxattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simplereadfrombuffer. When no configured xattrs are enabled, the...

curl: 57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`

Summary curleasyescapeccsid and curleasyunescapeccsid in projects/OS400/ccsidcurl.c discard the converted byte count returned by dynconvert and pass 0 to the downstream curleasyescape / curleasyunescape. When the caller supplies a positive explicit length with non-NUL-terminated input, dynconvert...

CVE-2026-74291

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

UBUNTU-CVE-2026-74291

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

EUVD-2026-59546

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evmxattrs read buffer evmreadxattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simplereadfrombuffer. When no configured xattrs are enabled, the...

CVE-2026-74291

CVE-2026-74291 concerns the Linux kernel ASoC topology parser. Affected: PCM/DAI name fields stored in fixed-size UAPI arrays. Root cause: those PCM/DAI paths forwarded non-NUL-terminated or unterminated name strings to C-strings, strlen(), and related lookups without prior bounded checks. Conseq...

CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...