24507 matches found
Apache HTTP Server: mod_auth_digest timing attack
...
Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
...
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
...
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
...
Apache HTTP Server: http2: double free and possible RCE on early reset
...
Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
...
Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
...
Gnutls: gnutls: denial of service via dtls zero-length fragment
...
wifi: rtw89: fix potential zero beacon interval in beacon tracking
...
hfs: Replace BUG_ON with error handling for CNID count checks
...
drm/amdgpu: validate user queue size constraints
...
hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin
...
APEI/GHES: ARM processor Error: don't go past allocated memory
...
drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
...
drm/amdgpu: fix NULL pointer issue buffer funcs
...
drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
...
drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
...
mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()
...
drm/amdgpu/ras: Move ras data alloc before bad page check
...
misc: ti_fpc202: fix a potential memory leak in probe function
...
wifi: rtw89: pci: validate release report content before using for RTL8922DE
...
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
...
Prometheus Azure AD remote write OAuth client secret exposed via config API
...
CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
...
CoreDNS DoH GET path missing size validation causes CPU and memory amplification
...
CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
...
CoreDNS TSIG authentication bypass on encrypted DNS transports
...
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
...
An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.
...
Nano: nano: format string vulnerability leads to denial of service
...
Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
...
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.
...
Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
...
media: vidtv: fix pass-by-value structs causing MSAN warnings
...
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
...
libssh2 userauth.c userauth_password integer overflow
...
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
...
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
...
f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
...
ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
...
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
...
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
...
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
...
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
...
fuse: reject oversized dirents in page cache
...
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
...
smb: server: fix active_num_conn leak on transport allocation failure
...
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
...