32226 matches found
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
...
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
...
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
...
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
...
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).
...
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.
...
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
...
Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader
...
Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients
...
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files
...
Docker Engine insecure-registry fallback via malicious DNS responses
...
Double flow control refund on HTTP/2 server streams in net/http
...
HTTP/2 server crash due to HPACK encoder race in net/http
...
HTTP/2 transport accepts malformed framing-related headers in net/http
...
Excessive CPU consumption from repeated initial window changes in net/http
...
HTTP/2 server memory exhaustion due to Trailer headers in net/http
...
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
...
Improper validation of PBMAC1 parameters in PKCS#12 MAC verification
...
NULL dereference in SSL_CIPHER_find() function on unknown cipher ID
...
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
...
Heap out-of-bounds write in BIO_f_linebuffer on short writes
...
TLS 1.3 CompressedCertificate excessive memory allocation
...
'openssl dgst' one-shot codepath silently truncates inputs >16MB
...
Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
...
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
...
ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
...
Missing ASN1_TYPE validation in PKCS#12 parsing
...
Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
...
Denial of Service via Eager Array Allocation During Deserialization in Guava
...
netfilter: ip6t_rpfilter: reject routes without inet6_dev
...
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
...
veth: manage XDP program pointers during channel resize
...
net/sched: reject IDR error pointers when deleting actions
...
bpf: Skip unsettled links in link iterator
...
bpf: Reject dev-bound-only programs on other devices
...
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
...
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
...
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
...
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
...
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.
...
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.
...
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.
...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.
...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.
...