18717 matches found
AZL-78333 CVE-2025-61145 affecting package libtiff for versions less than 4.6.0-11
libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c...
AZL-78363 CVE-2025-14905 affecting package 389-ds-base 3.1.1-12
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schemaattrenumcallback function within the schema.c file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting...
AZL-78270 CVE-2026-2903 affecting package re2c 2.0-1
A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function checkandmergespecialrules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name:...
AZL-78273 CVE-2026-2903 affecting package re2c 3.1-4
A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function checkandmergespecialrules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name:...
AZL-78282 CVE-2026-27211 affecting package cloud-hypervisor for versions less than 48.0.246-3
Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration constrained by process privileges when using virtio-block devices backed by raw images. A malicious guest can overwrite its disk header with a crafted...
AZL-78234 CVE-2026-2492 affecting package tensorflow for versions less than 2.16.1-11
TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target syste...
AZL-78246 CVE-2026-2492 affecting package tensorflow 2.11.1-2
TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target syste...
AZL-78285 CVE-2026-21620 affecting package erlang for versions less than 26.2.5.17-1
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp tftpfile modules, erlang otp inets tftpfile modules, erlang otp tftp tftpfile modules allows Relative Path Traversal. This vulnerability is associated with program files...
AZL-78278 CVE-2026-21620 affecting package erlang 25.3.2.21-4
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp tftpfile modules, erlang otp inets tftpfile modules, erlang otp tftp tftpfile modules allows Relative Path Traversal. This vulnerability is associated with program files...
AZL-78290 CVE-2026-2739 affecting package reaper 3.1.1-22
This affects versions of the package bn.js before 5.2.3. Calling maskn0 on any BN instance corrupts the internal state, causing toString, divmod, and other methods to enter an infinite loop, hanging the process indefinitely...
AZL-78123 CVE-2026-26958 affecting package keda 2.14.1-11
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...
AZL-78216 CVE-2026-26958 affecting package telegraf 1.31.0-15
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...
AZL-77976 CVE-2026-24834 affecting package kata-containers for versions less than 3.19.1.kata2-6
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM...
AZL-78174 CVE-2025-14876 affecting package qemu for versions less than 9.1.0-3
A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service DoS on the host system by causing the QEMU process to terminate...
AZL-77930 CVE-2026-23221 affecting package kernel for versions less than 6.6.130.1-1
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driveroverrideshow The driveroverrideshow function reads the driveroverride string without holding the devicelock. However, driveroverridestore uses driversetoverride, which modifies and frees t...
AZL-77939 CVE-2025-71235 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. 105954.384919 RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 105954.384920 R10:...
AZL-77951 CVE-2025-71233 affecting package kernel for versions less than 6.6.130.1-1
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes. The crash...
AZL-77963 CVE-2025-71232 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/unload test in a loop, 61110.449331 qla2xxx 0000:27:00.0-0042:0: Disabled MSI-X. 61110.467494...
AZL-77948 CVE-2025-71229 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix alignment fault in rtwcoreenablebeacon rtwcoreenablebeacon reads 4 bytes from an address that is not a multiple of 4. This results in a crash on some systems. Do 1 byte reads/writes instead. Unable to handle kern...
AZL-77858 CVE-2026-23213 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access MMIO registers during this window e.g., from...
AZL-77865 CVE-2026-23212 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave-lastrx slave-lastrx and slave-targetlastarprx... can be read and written locklessly. Add READONCE and WRITEONCE annotations. syzbot reported: BUG: KCSAN: data-race in bondrcvvalidate /...
AZL-77861 CVE-2026-23216 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsitdecconnusagecount In iscsitdecconnusagecount, the function calls complete while holding the conn-connusagelock. As soon as complete is invoked, the waiter such as...
AZL-77877 CVE-2026-23214 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new transactions if the fs is fully read-only BUG There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnings during unmount: BTRFS: Transaction...
AZL-77880 CVE-2025-71227 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't WARN for connections on invalid channels It's not clear to me how exactly syzbot managed to hit this, but it seems conceivable that e.g. regulatory changed and has disabled a channel between scanning channel...
AZL-77874 CVE-2025-71225 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raiddisks via sysfs In raid1reshape, freezearray is called before modifying the r1bio memory pool conf-r1biopool and conf-raiddisks, and unfreezearray is called after the update is completed...
AZL-78087 CVE-2026-2641 affecting package ctags 6.1.0-1
A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on t...
AZL-78012 CVE-2026-27171 affecting package gpsbabel 1.8.0-4
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78000 CVE-2026-27171 affecting package fltk 1.3.8-1
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78203 CVE-2026-27171 affecting package zlib 1.2.13-2
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78024 CVE-2026-27171 affecting package openjpeg2 2.3.1-12
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78120 CVE-2026-27171 affecting package kata-containers for versions less than 3.19.1.kata3-6
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78179 CVE-2026-27171 affecting package rust 1.72.0-14
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-77985 CVE-2026-27171 affecting package blosc 1.21.6-1
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78017 CVE-2026-27171 affecting package openjpeg2 2.3.1-12
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-77981 CVE-2026-27171 affecting package blosc 1.21.4-2
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-77988 CVE-2026-27171 affecting package clucene 2.3.3.4-40
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78009 CVE-2026-27171 affecting package gpsbabel 1.8.0-4
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-77990 CVE-2026-27171 affecting package clucene 2.3.3.4-38
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-77886 CVE-2026-27171 affecting package zlib for versions less than 1.3.2-1
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78027 CVE-2026-27171 affecting package teckit 2.5.12-4
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-77993 CVE-2026-27171 affecting package fltk 1.3.5-4
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78014 CVE-2026-27171 affecting package ogdi 4.1.0-9
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78021 CVE-2026-27171 affecting package ogdi 4.1.1-3
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
AZL-78129 CVE-2026-25087 affecting package libarrow for versions less than 15.0.0-8
Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file but not an IPC stream with pre-buffering enabled, if the IPC file contains data with variadic buffers such as Binary View and String...
AZL-77739 CVE-2026-23209 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlancommonnewlink valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip lin...
AZL-77712 CVE-2026-23208 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Prevent excessive number of frames In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize0 22 packsize1 23. The buffer size for each data URB is maxpacksize...
AZL-80106 CVE-2026-23207 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect currxfer check in IRQ handler Now that all other accesses to currxfer are done under the lock, protect the currxfer NULL check in tegraqspiisrthread with the spinlock. Without this protection, the...
AZL-77658 CVE-2026-23204 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: use skbheaderpointercareful skbheaderpointer does not fully validate negative @offset values. Use skbheaderpointercareful instead. GangMin Kim provided a report and a repro fooling u32classify: BUG: KASAN:...
AZL-77667 CVE-2026-23206 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZEROSIZEPTR dereference when numifs is zero The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc with ethsw-swattr.numifs as the element count. When the device reports zero interfaces...
AZL-77808 CVE-2026-23200 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTFADDRCONF syzbot reported a kernel BUG in fib6addrt2node when adding an IPv6 route. 0 Commit f72514b3c569 "ipv6: clear RA flags when adding a static route" introduced logic to...