23144 matches found
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
...
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
...
Vitess allows HTML injection in /debug/querylogz & /debug/env
...
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
...
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
...
llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.
...
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
...
Arbitrary Code Execution via Crafted Keras Config for Model Loading
...
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
...
Timing side-channel in ECDSA signature computation
...
net/mlx5: Clear port select structure when fail to create
...
vsock/virtio: discard packets if the transport changes
...
net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
...
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
...
btrfs: avoid NULL pointer dereference if no valid extent tree
...
net: fec: handle page_pool_dev_alloc_pages error
...
iomap: avoid avoid truncating 64-bit offset to 32 bits
...
openvswitch: fix lockup on tx to unregistering netdev with carrier
...
sctp: sysctl: rto_min/max: avoid using current->nsproxy
...
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
...
filemap: avoid truncating 64-bit offset to 32 bits
...
sctp: sysctl: auth_enable: avoid using current->nsproxy
...
usbnet: ipheth: use static NDP16 location in URB
...
blk-cgroup: Fix class @block_class's subsystem refcount leakage
...
usbnet: ipheth: fix DPE OoB read
...
USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
...
fs/proc: fix softlockup in __read_vmcore (part 2)
...
nilfs2: fix possible int overflows in nilfs_fiemap()
...
usbnet: ipheth: fix possible overflow in DPE length check
...
net/rose: prevent integer overflows in rose_setsockopt()
...
bpf: Fix bpf_sk_select_reuseport() memory leak
...
pktgen: Avoid out-of-bounds access in get_imix_entries
...
smb: client: fix double free of TCP_Server_Info::hostname
...
vsock/bpf: return early if transport is not assigned
...
ipvlan: Fix use-after-free in ipvlan_get_iflink().
...
mptcp: sysctl: sched: avoid using current->nsproxy
...
vfio/platform: check the bounds of read/write syscalls
...
net: sched: fix ets qdisc OOB Indexing
...
ptp: Ensure info->enable callback is always set
...
net: rose: lock the socket in rose_bind()
...
ksmbd: fix integer overflows on 32 bit systems
...
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
...
mptcp: consolidate suboption status
...
gpio: xilinx: Convert gpio_lock to raw spinlock
...
NFC: nci: Add bounds checking in nci_hci_create_pipe()
...
tty: xilinx_uartps: split sysrq handling
...
vxlan: Fix uninit-value in vxlan_vnifilter_dump()
...
net: rose: fix timer races against user threads
...
A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.
...