144034 matches found
chromium-browser: skia: Memory corruption in Skia
A memory corruption flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568936530...
chromium-browser: skia: Memory corruption in Skia
A memory corruption flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/570825067...
chromium-browser: skia: Uninitialized resource in Skia
An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561987051...
chromium-browser: skia: Memory corruption in Skia
A memory corruption flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/576194994...
chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation
A flaw was found in Skia, a 2D graphics library, within Google Chrome. This vulnerability, stemming from improper state validation, allows a remote attacker to exploit it. By enticing a user to visit a specially crafted HTML page, the attacker can obtain sensitive cross-origin data...
Important: Red Hat Security Advisory: webkit2gtk3 security update
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
chromium-browser: skia: chromium-browser: skia: Use after free in Skia
An use after free flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553345874...
chromium-browser: skia: Improper input validation in Skia
An improper input validation flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/574213633...
chromium-browser: skia: Use after free in Skia
An use after free flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/577403270...
chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability
A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could allow the attacker to obtain sensitive cross-origin data...
chromium-browser: skia: Integer overflow in Skia
An integer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562038679...
chromium-browser: skia: Improper input validation in Skia
An improper input validation flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/574776938...
chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia
A flaw was found in Skia, a 2D graphics library used in Google Chrome. This vulnerability, stemming from an uninitialized resource, allows a remote attacker to obtain sensitive cross-origin data. By crafting a malicious HTML page, an attacker can trick a user into visiting it, leading to the...
chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation
A flaw was found in Skia, a 2D graphics library used in chromium-browser. This improper state validation vulnerability allows a remote attacker, who has already compromised the renderer process, to read memory outside of the security sandbox. This can be achieved by enticing a user to open a...
chromium-browser: skia: chromium-browser: Uninitialized resource in Skia
An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=561994362 https://code.google.com/p/chromium/issues/detail?id=102325...
chromium-browser: skia: Memory corruption in Skia
A memory corruption flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553126587...
chromium-browser: skia: Improper input validation in Skia
An improper input validation flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568936430...
chromium-browser: skia: Out of bounds read in Skia
An out of bounds read flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/530237174...
bind: bind: Denial of service via assertion failure in RPZ query processing
A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...
bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay
A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...
bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling
A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid...
bind: BIND: Denial of Service via unbounded processing of crafted DNS messages
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...
Important: Red Hat Security Advisory: bind security, bug fix, and enhancement update
An update for bind is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
bind: BIND: Denial of Service via crafted DNSSEC reply
A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...
bind: BIND: Denial of Service via malformed DNS64 responses
A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the named process to exit unexpectedly. This can lead to a Denial of Service DoS for clients relying on the affected resolver...
bind: bind: Denial of Service via assertion failure during redirect processing
A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...
bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API Generic Security Service Application Program Interface tokens. This can lead to excessive memory consumption,...
bind: BIND: Denial of Service via malformed DNS64 responses
A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the named process to exit unexpectedly. This can lead to a Denial of Service DoS for clients relying on the affected resolver...
bind: BIND: Denial of Service via specially crafted DNS messages
A flaw was found in the bind component, specifically within the named daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System DNS messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the named daemon when...
bind: bind: Denial of Service via assertion failure during redirect processing
A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...
bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling
A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid...
bind: bind9: Incorrect acceptance of NSEC3 records
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...
bind: bind: Denial of Service via long query names in RPZ processing
A flaw was found in BIND. A remote attacker can send specially crafted, excessively long query names to a resolver configured with Response Policy Zones RPZ and wildcard policies. Improper handling of the resulting error condition can cause the service to terminate unexpectedly, leading to a Deni...
Important: Red Hat Security Advisory: bind security, bug fix, and enhancement update
An update for bind is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...
bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...
bind: bind9: Unexpected exit with NSEC and NSEC3 both present
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...
bind: BIND: Denial of Service via unbounded processing of crafted DNS messages
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...
bind: BIND: Denial of Service via crafted DNSSEC reply
A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...
bind: bind: Denial of service via assertion failure in RPZ query processing
A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...
bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay
A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...
bind: bind9: Potential memory usage beyond configured limits
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...
kernel: sctp: stream: fully roll back denied add-stream state
A flaw was found in the Linux kernel's SCTP stream scheduler. When transient outgoing streams are denied and torn down, the kernel fails to reclaim scheduler-specific metadata before an algorithm switch e.g., WFQ to PRIO. The orphaned state - including internal accounting fields - becomes reachab...
kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()
A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...
kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker ...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
kernel: sctp: clear new_transport when removing a peer
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resultin...
kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...
kernel: openvswitch: Fix CT limit teardown use-after-free
A flaw was found in the Linux kernel's Open vSwitch OVS component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packet processing attempts to use connection tracking CT limit...
resteasy-core: RESTeasy SourceProvider remote unauthenticated file read
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...