32226 matches found
Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit
...
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
...
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
...
Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)
...
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
...
Out-of-bounds Read in GNU Aspell
...
Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
...
drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
...
Heap Buffer Overflow in GNU Aspell's prezip utility
...
Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
...
hwmon: (pmbus/core) increase number of phases and add new mask
...
Integer Truncation Leading to Heap Corruption in GNU Aspell
...
Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
...
swiotlb: use the adjusted address for the highmem page lookup
...
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.
...
Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements
...
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
...
Canimaan Software ClamXAV local privilege escalation
...
nvme-apple: Prevent shared tags across queues on Apple A11
...
Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)
...
Apache Thrift: C++ THttpTransport grows its line buffer without bound
...
Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)
...
Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame
...
Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)
...
Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound
...
Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception
...
Apache Thrift: Perl servers end `serve()` when serving one connection fails
...
Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
...
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
...
Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service
...
RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
...
RabbitMQ: CORS * reflects Origin with Allow-Credentials
...
RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
...
RabbitMQ: Web-MQTT decompression bomb
...
RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
...
RabbitMQ: Stream-protocol frame length never validated against frame_max
...
RabbitMQ: Atom table exhaustion via stream `chunk_selector`
...
RabbitMQ: ReDoS via management API ?name= filter
...
RabbitMQ: Monitoring-tag user can DELETE shovels
...
RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
...
RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
...
RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
...
RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status
...
RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
...
RabbitMQ: Stream protocol skips per vhost per user connection limits
...
RabbitMQ: Consistent-hash exchange unbounded weight
...