CVE-2023-39593

MariaDB 10.5 Authenticated Code execution-sysexec This guide provides detailed instructions to exploit a User-Defined Function UDF vulnerability in MariaDB on a remote server. These steps include downloading and executing malicious code on a vulnerable database system. Warning: This document is f...

CVE-2026-32710

CVE-2026-32710 Heap buffer overflow in MariaDBJSONSCHEMAVALID → persistent privilege escalation → UDF RCE | ---|--- Affected| MariaDB 11.4.x confirmed on 11.4.9 Bug| OOB write in jsongetnormalizedstring — strncpy into 128-byte DYNAMICSTRING with no bounds check Impact| SELECT-only user → ALL...

Serious-Sam---CVE-2021-36934-Mitigation-for-Datto-RMM

Overview This is a Datto RMM component to mitigate CVE-2021-36934, aka Serious SAM. It follows the mitigation measures outlined at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 https://kb.cert.org/vuls/id/506989 USE AT YOUR OWN RISK. EXPECT THIS TO BREAK SOME BACKUPS...

MYSQL-UDF-Exploit

MYSQL-UDF-Exploit MYSQL UDF Exploit...

CVE-2024-27766

CVE-2024-27766 MariaDB v11.1 RCE via UDF — modified PoC based on Ant1sec-ops/CVE-2024-27766. Overview | ---|--- Affected| MariaDB v11.1 Fixed in| 10.5.25 / 10.6.18 / 10.11.8 / 11.0.6 / 11.1.5 / 11.2.4 / 11.4.2+ Type| RCE via User-Defined Function UDF MariaDB v11.1 allows an attacker with sufficie...

UDFPwn-CVE-2012-5613

UDFPwn.py MySQL 4.x/5.0 Linux - User-Defined Function UDF Dynamic Library 2 automation script...

Mysql_CVE-2024-27766

Exploit Reproduction Guide affected product version MariaDB 11.1 This guide provides step-by-step instructions to reproduce a User-Defined Function UDF attack on a database system. Please note that this exploit may work on some systems, but it might not function correctly on 64-bit architectures ...

BIT-MARIADB-MIN-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

BIT-MARIADB-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-93140

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. When an I/O error occurs during the writing of the Logical Volume Integrity Descriptor LVID buffer, the system incorrectly clears a flag indicating the buffer's validity. Subsequent operations, such as remounting the...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45991)

In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in partdescsloc. handlepartitiondescriptor deduplicates entries by partition...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: udf: The use of uninit-value in udfgetfileshortad has been fixed. A check for overflow was added when calculating alen in udfcurrentaext, to mitigate potential issues with uninit-value usage in udfgetfileshortad. This is related ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: udf: Validation of free block extents against the partition length The udffreeblocks function checks the logical block number and count against the partition length. However, the extent offset is dropped from this final value. A...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double calls to brelse in udfrename syzbot reported a warning like below 1: VFS: brelse: Trying to free a free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 brelse+0x67/0xa0 ... Call Trace:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fs: udf: Fix for OOB read in lengthAllocDescs handling When parsing the Allocation Extent Descriptor, lengthAllocDescs is derived from disk-based data and must be validated against the block size. Corrupted or crafted images m...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: udf: The validation of the VAT header length is performed based on the VAT inode size. The udfloadvat function retrieves the start offset of the virtual partition directly from the disk’s VAT 2.0 header, without checking it again...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: udf: The validation of the sparing table length is performed based on the number of entries, not the number of bytes. The udfloadsparablemap function accepts a sparing table when the condition sizeofst +...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: udf: Fixed NULL pointer dereferencing in the udfsymlink function. In the udfsymlink function, epos.bh is assigned the value returned by udftgetblk. The udftgetblk function is defined in udf/misc.c and returns the value of the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: udf: Rejects indexes that are equal to the number of entries. UDF 1.50 virtual partition mapping uses VAT as an array of physical block mappings. snumEntries stores the number of entries in that array, not the highest valid index...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...