Unity Linux 20.1070e Security Update: djvulibre (UTSA-2025-680671)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680671 advisory. DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack application crash via an out-of- bounds read by crafting a corrupted JB2 image file that is...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-384214)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-384214 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtkdrmgemobj Add a check to mtkdrmgeminit if we attempt to...

EUVD-2024-20861

Malicious code in bioql PyPI...

@nubosoftware/node-static failure to catch exception can result in server crash

This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server...

GHSA-JC7W-C686-C4V9 github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

Summary It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA head...

Linux Distros Unpatched Vulnerability : CVE-2016-8646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The hashaccept function in crypto/algifhash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service OOPS by attempting to trigger use...

Division by zero

Overview nvidia-pytriton is a PyTriton - Flask/FastAPI-like interface to simplify Triton's deployment in Python environments. Affected versions of this package are vulnerable to Division by zero via the TopkClassifications function in the classification processing path. An attacker can cause a...

CVE-2017-11757

Heap-based buffer overflow in Actian Pervasive PSQL v12.10 and Zen v13 allows remote attackers to execute arbitrary code via crafted traffic to TCP port 1583. The overflow occurs after Server-Client encryption-key exchange. The issue results from an integer underflow that leads to a zero-byte...

CVE-2012-4695

LogReceiver.exe in Rockwell Automation RSLinx Enterprise CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage via a zero-byte UDP packet that is not properly handled by Logger.dll...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the spi-mem module not handling the zero virtual byte case, which could result in a divide-by-zero error...

K000151336: Linux kernel vulnerability CVE-2024-25739

Security Advisory Description createemptylvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi-lebsize. CVE-2024-25739 Impact There is no impact; F5 products are not affected by this vulnerability. Securi...

kernel: crash due to a missing check for leb_size

A flaw was found in the Linux kernel. The createemptylvol function in the drivers/mtd/ubi/vtbl.c file can attempt to allocate zero bytes of memory when the LEB size is smaller than a single volume table record. This issue can result in a denial of service...

CVE-2025-2265

The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if the hash contains a zero byte...

Linux Distros Unpatched Vulnerability : CVE-2015-8948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-boun...

CVE-2025-27145

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execu...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the drag-drop action on the Web-UI. An attacker can execute arbitrary JavaScript with the same privileges as the user by tricking them into dragging a maliciously-named, zero-byte file into the interface...

Astra Linux – Vulnerability in libvirt

A flaw was discovered in libvirt. A refactoring of the code that retrieves the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case could lead to a NULL pointer being dereferenced, causing the...

The vulnerability of the MongoDB database management system lies in improper handling of zero bytes during BSON data processing. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the MongoDB database management system server is related to improper elimination of zero bytes. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures by sending specially crafted queries...

kernel: crash due to a missing check for leb_size

A flaw was found in the Linux kernel. The createemptylvol function in the drivers/mtd/ubi/vtbl.c file can attempt to allocate zero bytes of memory when the LEB size is smaller than a single volume table record. This issue can result in a denial of service...

The vulnerability of the os.path.normpath() function in the Python interpreter lies in its ability to bypass permission checks when shortening a path by inserting a zero byte. This allows an attacker to compromise the integrity of the protected information.

The vulnerability of the os.path.normpath function in the Python interpreter relates to the handling of permission lists when shortening a path by inserting a zero byte. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the integrity of protected information...