18717 matches found
AZL-99884 CVE-2026-13608 affecting package tensorflow 2.16.1-11
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle MITM attack can inject a premature or shortcut response that bypasses complete peer...
AZL-99762 CVE-2026-13608 affecting package curl 8.11.1-11
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle MITM attack can inject a premature or shortcut response that bypasses complete peer...
AZL-99786 CVE-2026-13608 affecting package cmake 3.30.3-15
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle MITM attack can inject a premature or shortcut response that bypasses complete peer...
AZL-99861 CVE-2026-13608 affecting package rust 1.90.0-10
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle MITM attack can inject a premature or shortcut response that bypasses complete peer...
AZL-99747 CVE-2026-6554 affecting package libpcap for versions less than 1.10.7-1
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely...
AZL-99924 CVE-2026-6554 affecting package nmap 7.95-5
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely...
AZL-99933 CVE-2026-0799 affecting package nmap 7.95-5
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...
AZL-99735 CVE-2026-18313 affecting package libpcap for versions less than 1.10.7-1
rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster...
AZL-99930 CVE-2026-31911 affecting package nmap 7.95-5
libpcap BPF interpreter calls abort if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process...
AZL-99744 CVE-2026-0799 affecting package libpcap for versions less than 1.10.7-1
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...
AZL-99921 CVE-2026-31912 affecting package nmap 7.95-5
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the...
AZL-99741 CVE-2026-31912 affecting package libpcap for versions less than 1.10.7-1
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the...
AZL-99927 CVE-2026-18238 affecting package nmap 7.95-5
The rpcap client code that processes a RPCAPMSGPACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the...
AZL-99936 CVE-2026-6244 affecting package nmap 7.95-5
libpcap BPF interpreter for the 'div k' and 'mod k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero...
AZL-99732 CVE-2026-31911 affecting package libpcap for versions less than 1.10.7-1
libpcap BPF interpreter calls abort if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process...
AZL-99738 CVE-2026-6244 affecting package libpcap for versions less than 1.10.7-1
libpcap BPF interpreter for the 'div k' and 'mod k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero...
AZL-99729 CVE-2026-18238 affecting package libpcap for versions less than 1.10.7-1
The rpcap client code that processes a RPCAPMSGPACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the...
AZL-99726 CVE-2026-86145 affecting package pcre2 for versions less than 10.48-1
PCRE2 before 10.48 allows a pcre2dfamatch out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check even though a newly allocated block, for the same purpose, does have a size check. This outcome requires an attacker-controlled regula...
AZL-99705 CVE-2026-86143 affecting package libxml2 for versions less than 2.11.5-11
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
AZL-99720 CVE-2026-86142 affecting package libxml2 for versions less than 2.11.5-11
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...
AZL-99708 CVE-2026-86141 affecting package libxml2 2.11.5-10
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...
AZL-99702 CVE-2026-86144 affecting package libxml2 for versions less than 2.11.5-11
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...
AZL-99717 CVE-2026-86140 affecting package libxml2 for versions less than 2.11.5-11
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...
AZL-99711 CVE-2026-86138 affecting package libxml2 for versions less than 2.11.5-11
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...
AZL-99714 CVE-2026-86139 affecting package libxml2 2.11.5-10
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...
AZL-99723 CVE-2026-86137 affecting package libxml2 for versions less than 2.11.5-11
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
AZL-99894 CVE-2026-86095 affecting package netcdf 4.9.0-4
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...
AZL-99945 CVE-2026-86098 affecting package ntopng 5.2.1-6
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...
AZL-99693 CVE-2026-86091 affecting package ntopng 5.2.1-6
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
AZL-99690 CVE-2026-86090 affecting package ntopng 5.2.1-6
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
AZL-99918 CVE-2026-85769 affecting package libtpms for versions less than 0.9.6-9
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...
AZL-99443 CVE-2026-80912 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array by pclasses.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. selmakeclasses passes every...
AZL-99455 CVE-2026-80913 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...
AZL-99636 CVE-2026-80909 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...
AZL-99629 CVE-2026-80905 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transportheader when sending VLAN-tagged frame In tapgetuserxdp, when processing a VLAN-tagged frame e.g. ETHP8021Q, skbsetnetworkheader is called first to advance networkheader past the VLAN tag to the inner...
AZL-99579 CVE-2026-80906 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...
AZL-99648 CVE-2026-80907 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...
AZL-99440 CVE-2026-80908 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10...
AZL-99549 CVE-2026-80910 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...
AZL-99470 CVE-2026-80911 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...
AZL-99525 CVE-2026-80904 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...
AZL-99450 CVE-2026-80902 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leaving non-cyclic descriptors and their LLI...
AZL-99582 CVE-2026-80899 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a loc...
AZL-99662 CVE-2026-80901 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ipvsinicmpv6 is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or o...
AZL-99555 CVE-2026-80892 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressorlzma.c sizes the module-global MicroLZMA stream pool from numpossiblecpus when the lzmastreams module parameter is unset, then zerofsloadlzmaconfig preallocates one...
AZL-99477 CVE-2026-80891 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a...
AZL-99609 CVE-2026-80893 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...
AZL-99642 CVE-2026-80890 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...
AZL-99603 CVE-2026-80887 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use checkaddoverflow for shader size+offset bound vmwshaderdefine validates the user-supplied shader window against its backing buffer with u64buffer-tbo.base.size guestmemoryoffset and forwarded to host SVGA...
AZL-99684 CVE-2026-80888 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...