24590 matches found
Use of Out-of-range Pointer Offset in mruby/mruby
...
scsi: hisi_sas: Create all dump files during debugfs initialization
...
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3.
...
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
...
usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
...
NULL Pointer Dereference in mrb_vm_exec with super in mruby/mruby
...
An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.
...
drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
...
uprobe: avoid out-of-bounds memory access of fetching args
...
Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc
...
smb: prevent use-after-free due to open_cached_dir error paths
...
wifi: ath10k: avoid NULL pointer error during sdio remove
...
bnxt_en: Fix receive ring space parameters when XDP is active
...
An unlimited recursion in DxeCore in EDK II.
...
Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244.
...
Mishandling of corrupt central directory record in archive/zip
...
Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init
...
i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
...
NULL Pointer Dereference in mruby/mruby
...
atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop.
...
net: batman-adv: fix error handling
...
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
...
A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.
...
HID: core: Harden s32ton() against conversion to 0 bits
...
RDMA/siw: Remove direct link to net_device
...
Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc
...
tpm: Lock TPM chip in tpm_pm_suspend() first
...
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
...
vfio/fsl-mc: Block calling interrupt handler without trigger
...
kunit/overflow: Fix UB in overflow_allocation_test
...
fsdax: Fix infinite loop in dax_iomap_rw()
...
vfio/pci: Disable auto-enable of exclusive INTx IRQ
...
Perl: write past buffer end via illegal user-defined unicode property
...
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
...
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
...
vmci: Prevent the dispatching of uninitialized payloads
...
KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
...
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
...
An issue was discovered in Arm Mbed TLS before 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable.
...
ksmbd: validate payload size in ipc response
...
srcu: Tighten cleanup_srcu_struct() GP checks
...
Libopensc: incorrect handling of the length of buffers or files in pkcs15init
...
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
...
An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c.
...
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.
...
An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c.
...
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
...
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c.
...