28472 matches found
net/packet: defer vmalloc TX_RING free until skbs finish
...
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
...
crypto: sun8i-ce - Remove crypto_rng interface
...
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
...
xfrm: ah6: validate routing header segments_left
...
HID: core: fix OOB read of field->usage in hid_set_field()
...
usb: core: Add lock to usb_wakeup_notification()
...
crypto: mxs-dcp - fix source scatterlist length access
...
nfc: digital: clamp SENSF_RES length to the destination buffer
...
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
...
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
...
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).
...
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
...
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
...
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).
...
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
...
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
...
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
...
zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate
...
rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix
...
Colord: Slow rejection of oversized malformed color strings
...
util-linux libmount Privilege Escalation via Failed Mount Helper
...
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
...
selinux: do not cancel a policy conversion that never started
...
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
...
Input: psxpad-spi - set driver data before use
...
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
...
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
...
Revert "drm/amdgpu: fix aperture mapping leak"
...
selinux: reject a permission value exceeding the class permission count
...
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
...
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
...
net: remove WARN_ON_ONCE() from sk_mc_loop()
...
serial: amba-pl011: synchronize DMA teardown
...
drm/amdkfd: Add bounds check for CRAT subtype length
...
selinux: reject a class permission count below its inherited common
...
af_packet: Don't send zero-byte data in tpacket_snd().
...
ata: pata_sl82c105: fix bridge revision use-after-free
...
`openvm-pairing` pairing check missing proper subfield check on scaling factor
...
Potential code smuggling via doc comments in cmd/cgo
...
Excessive CPU consumption when building archive index in archive/zip
...
Unexpected code execution when invoking toolchain in cmd/go
...
Handshake messages may be processed at the incorrect encryption level in crypto/tls
...
Arbitrary file write using cgo pkg-config directive in cmd/go
...
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep
...
Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
...
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
...
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
...
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault
...
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
...