105225 matches found
Eclipse ThreadX GUIX buffer error vulnerability
Eclipse ThreadX GUIX versions 6.5.1.202602a and earlier contain a buffer error vulnerability. This vulnerability arises because the PNG block reader fails to validate the order of blocks; it allows reading the IHDR after the IDAT and overwriting the image dimensions. As a result, when performing...
Eclipse ThreadX GUIX numeric error vulnerability
The Eclipse ThreadX GUIX has a security vulnerability. This vulnerability arises because the GUIX binary resource loader fails to validate the glyph range of font pages. When firstglyph exceeds lastglyph, a count underflow occurs. Additionally, an unchecked multiplication wrapup in buffer size...
Eclipse ThreadX FileX input validation error vulnerability
Versions 6.5.1.202602 and earlier of Eclipse ThreadX FileX contain a security vulnerability. This vulnerability arises when an attacker with control over the FAT image that enables fault tolerance mounts a filesystem, leading to an out-of-bounds heap write during log replay. Both the location and...
Eclipse ThreadX buffer error vulnerability
A buffer error vulnerability exists in Eclipse ThreadX versions 6.1 through 6.5.1.202602a. This vulnerability arises because the Cortex-A7 MMU Modules port only validates the address of the first byte in the buffer; it fails to verify the full length and the actual instance of the module. As a...
uTox path traversal vulnerability
uTox versions 0.18.1 and earlier contain a path traversal vulnerability. This vulnerability arises from path traversal, allowing attackers to write arbitrary files by sending absolute paths or ../ filenames when the victim enables auto-accepting connections. This can overwrite shell startup files...
Python Packaging Authority virtualenv post-link vulnerability
The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a post-release vulnerability. This vulnerability stems from the handling of errors during the safedelete function’s deletion operations. When deletion fails, the error handling code uses os.lstatpath to read the file mode...
CLSA-2026-1792425300 rsync: Fix of CVE-2026-70461
CVE-2026-70461: heap out-of-bounds write in addimpliedinclude -- trailing backslash not counted when sizing the implied-include rule...
CLSA-2026-1792425174 rsync: Fix of CVE-2026-70461
CVE-2026-70461: heap out-of-bounds write in addimpliedinclude -- trailing backslash not counted when sizing the implied-include rule...
EUVD-2026-104412
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice
A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that...
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling
A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...
xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes
A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...
xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes
A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling
A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice
A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that...
CVE-2026-112275
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...
DEBIAN-CVE-2026-112275
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...
AZL-109460 CVE-2026-112275 affecting package netpbm 10.90.00-6
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...
CVE-2026-112262
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...
UBUNTU-CVE-2026-112275
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...