CVE-2022-0185-Case-Study

CVE-2022-0185-Case-Study This case study is a result of an assignment of ECE 9069: Introduction to Hacking : https://whisperlab.org/introduction-to-hacking/ CVE-2022-0185 Overview CVE-2022-0185 is a heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesyst...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150437)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150437 advisory. A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP...

CLSA-2026-1792239628 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CLSA-2026-1792238729 gstreamer1-plugins-good: Fix of 4 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CVE-2026-111075

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

EUVD-2026-107138

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

PT-2026-120494

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

Eclipse OpenJ9 buffer error vulnerability

A security vulnerability exists in Eclipse OpenJ9 versions prior to 0.63.0. This vulnerability stems from the JITServer component’s failure to perform cross-field validation on fields such as size, paddingSize, and dataOffset when deserializing DataDescriptor messages. Unauthenticated remote...

EUVD-2026-105140

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure allows a malicious TLS 1.3 server to trigger an unsigned-integer underflow . This results in a heap out-of-bounds read in any peer processing a remote Certificate message. The vulnerability is reachable pre-authentica...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

PT-2026-118433

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CLSA-2026-1792255236 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the pasteselection function, which releases the selection mutex lock during a loop. As a result, concurrent TIOCLINUX ioctl operations can reduce the vcsel.buflen to a value below pasted, leading to unsigned integer...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen using reversed operands: dlen = sizeofga - ga-len; ga-len represents the length of the on-wire attribute and...

CVE-2026-83742

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...