107416 matches found
CVE-2026-111880 FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...
CVE-2026-111880
FreeRDP versions 2.0.0 before 3.32.0 are vulnerable to a heap out-of-bounds write within the server hash-callback NTLM path. The root cause is a failure to validate the MIC offset , allowing unauthenticated attackers to send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MI...
CVE-2026-111880 FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...
Linux Kernel Security Vulnerabilities
The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from the index used by blkrevalidatezoneCond, which is derived from the reportzones function in the device driver. This index does not verify the size of the zonescond array. When the number of regions...
Linux Kernel Security Vulnerabilities
Versions of the Linux kernel from 6.12.29 to 6.12.112, as well as versions from 6.14.7 to 6.15, and 6.15 itself, have security vulnerabilities. This vulnerability stems from the fbnicmbxresetdescring function, which only sets AWFLUSH without setting AWFLUSHMODE when removing the FW mailbox Rx rin...
Linux Kernel Security Vulnerabilities
The Linux kernel has a security vulnerability. This vulnerability arises from the GUE REMSUM option not verifying the order of the checksum’s start value and the field offset. When the offset is less than the start value, underflow occurs, potentially leading to forwarded packets being written...
Linux Kernel Security Vulnerabilities
The Linux kernel version 4.10 contains security vulnerabilities. These vulnerabilities arise from the fact that when netdevsetnumtc reduces the numtc, the tctotxq and priotcmap arrays are not cleaned up properly. This leads to netdevtxqtotc returning an out-of-range traffic category. Additionally...
Linux Kernel Security Vulnerabilities
There are security vulnerabilities in the Linux kernel versions from 6.12.16 to 6.13, from 6.13.4 to 6.14, from 5.15.179 to 5.16, from 6.1.130 to 6.2, from 6.6.81 to 6.7, from 5.10.235 to 5.11, and in 6.14. The vulnerability stems from the fact that the dstdevoverhead function does not reserve...
Linux Kernel Security Vulnerabilities
The Linux kernel version 5.11 contains security vulnerabilities. One of these vulnerabilities arises from sockmapalloc, which does not reject entries greater than INTMAX. Additionally, sockmapfree uses a signed int to iterate through the sks array, leading to integer overflows and potential...
Linux Kernel Security Vulnerabilities
The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from the netfsreadgaps function, which does not clear the read gaps surrounding the streaming write to the dirty area. As a result, short reads on the server side or EOF responses may retain outdatedfolio...
RTMPDump: Buffer Overflow Vulnerability in the librtmp Library
The librtmp version 2.6 and earlier have a buffer error vulnerability. This vulnerability stems from AMF3Decode ignoring failed AMF3 attribute decoding. Malicious RTMP servers or interrupters can send extremely large AMF3 strings, thereby destroying heap memory and leaking heap bytes when the...
kernel: Fix of 69 CVEs
sctp: fix errchunk memory leaks in INIT handling CVE-2026-72413 - ACPICA: Fix use-after-free in acpidsterminatecontrolmethod CVE-2026-97455 - ACPICA: Enhance buffer validation in acpiutwalkamlresources CVE-2026-97445 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - wifi:...
CLSA-2026-1791949745 kernel: Fix of 69 CVEs
sctp: fix errchunk memory leaks in INIT handling CVE-2026-72413 - ACPICA: Fix use-after-free in acpidsterminatecontrolmethod CVE-2026-97455 - ACPICA: Enhance buffer validation in acpiutwalkamlresources CVE-2026-97445 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - wifi:...
CLSA-2026-1792066324 openssl: Fix of CVE-2026-84782
CVE-2026-84782: reset initoff before a DTLS retransmission and skip retransmitting while a handshake write is still suspended...
openssl: Fix of CVE-2026-84782
CVE-2026-84782: reset initoff before a DTLS retransmission and skip retransmitting while a handshake write is still suspended...
CLSA-2026-1792165466 tigervnc: Fix of CVE-2026-50264
CVE-2026-50264: fix out-of-bounds heap write in DRI2 DRIGetBuffers; carried by xorg-x11-server-source = 1.20.4-99.el79.tuxcare.els14, no local patch...
portswigger-labs-writeups
PortSwigger Labs — Write-ups & Solutions Personal write-up re...
MGASA-2026-0517 Updated mutt package fixes a security vulnerability
When an email is processed as a template, an out-of-bounds write vulnerability in the convertfilefromto function can be triggered by a specially crafted Content-Type header CVE-2026-107570...
MGASA-2026-0514 Updated libreoffice package fixes security vulnerabilities
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality. CVE-2026-63266 LFI and GET SSRF via calcext:data-mappings and csv provider. CVE-2026-63267 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href. CVE-2026-63268 LFI and GET SSRF via...
Updated mutt package fixes a security vulnerability
When an email is processed as a template, an out-of-bounds write vulnerability in the convertfilefromto function can be triggered by a specially crafted Content-Type header CVE-2026-107570...