28854 matches found
Nano: nano: format string vulnerability leads to denial of service
...
Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
...
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.
...
Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
...
Binutils: binutils: denial of service via crafted elf file
...
media: vidtv: fix pass-by-value structs causing MSAN warnings
...
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
...
libssh2 userauth.c userauth_password integer overflow
...
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
...
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
...
f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
...
ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
...
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
...
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
...
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
...
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
...
fuse: reject oversized dirents in page cache
...
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
...
smb: server: fix active_num_conn leak on transport allocation failure
...
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
...
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
...
bpf: Fix incorrect pruning due to atomic fetch precision tracking
...
Bluetooth: hci_event: move wake reason storage into validated event handlers
...
mpls: add seqcount to protect the platform_label{,s} pair
...
HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
...
net: use skb_header_pointer() for TCPv4 GSO frag_off check
...
HID: core: Mitigate potential OOB by removing bogus memset()
...
xfs: close crash window in attr dabtree inactivation
...
FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions
...
Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization
...
shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
...
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
...
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
...
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
...
rtnetlink: add missing netlink_ns_capable() check for peer netns
...
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
...
Chromium: CVE-2026-7355 Use after free in Media
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7340 Integer overflow in ANGLE
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7339 Heap buffer overflow in WebRTC
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7341 Use after free in WebRTC
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7338 Use after free in Cast
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7345 Insufficient validation of untrusted input in Feedback
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7346 Inappropriate implementation in Tint
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7347 Use after free in Chromoting
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7337 Type Confusion in V8
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7336 Use after free in WebRTC
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7335 Use after free in media
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7348 Use after free in Codecs
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7349 Use after free in Cast
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-7350 Use after free in WebMIDI
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...