145300 matches found
expat: expat: Denial of Service via integer overflow in expat_realloc
A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expatrealloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the...
expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer
A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist ...
Important: Red Hat Security Advisory: expat security update
An update for expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Important: Red Hat Security Advisory: pcre2 security update
An update for pcre2 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...
pcre2: pcre2: Out-of-bounds write via crafted regular expression
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...
Important: Red Hat Security Advisory: pcre2 security update
An update for pcre2 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
pcre2: pcre2: Out-of-bounds write via crafted regular expression
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...
pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...
tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing
A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...
Important: Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
tomcat: Apache Tomcat: Security constraint bypass due to improper access control
A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...
tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...
tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure
A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...
tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of reques...
tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb10.11: mariadb10.11-3:10.11.18-4.1.10.hum1 aarch64, s390x, x8664 mariadb10.11-backup-3:10.11.18-4.1.10.hum1 aarch64, s390x, x8664 mariadb10.11-client-utils-3:10.11.18-4.1.10.hum1 noarch...
mariadb: MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
A flaw was found in MariaDB. An authenticated remote attacker can supply a crafted table name with the mysql50 prefix, which bypasses normal filesystem encoding for table names. By accessing files under unencoded legacy names, the attacker can achieve arbitrary code execution, exfiltrate sensitiv...
github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input
A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.12: opentofu1.12-1.12.11-0.1.hum1 aarch64, s390x, x8664 opentofu1.12-1.12.11-0.1.hum1.src src...
dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...
Important: Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update
An update for .NET 10.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...
brotli: Out-of-Bounds Write in Google Brotli Decoder
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...
Important: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
An update for .NET 8.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
Important: Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update
An update for .NET 9.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...
Important: Red Hat Security Advisory: .NET 11.0 security, bug fix, and enhancement update
An update for .NET 11.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...
.NET: .NET Elevation of Privilege Vulnerability
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...
pillow: pillow: Denial of Service via zero-size images in rank filters
A flaw was found in Pillow. An attacker can cause a Denial of Service DoS by submitting a zero-size image to an application that applies rank-based filters, such as median, minimum, or maximum filters. When attempting to expand the image borders, Pillow reads from unallocated image storage,...
pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images
A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image with a width of zero to an application performing morphology operations. Because Pillow fails to validate zero-width image geometry during these operations, it attempts an...
pillow: pillow: Denial of service via double free during image transformation
A flaw was found in Pillow. A remote attacker who can submit large image transformation operations under memory pressure can trigger improper error handling, leading to a double-free vulnerability releasing the same memory block twice. This issue can result in an application crash, causing a Deni...
pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()
A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...
pillow: pillow: Denial of Service via infinite loop during PDF page rewriting
A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS through an infinite loop during PDF page processing. When rewriting pages, the parser fails to detect circular references in the page tree hierarchy. By submitting a specially crafted PDF...
pillow: pillow: Denial of Service via crafted multi-frame image conversion
A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...
pillow: pillow: Denial of service via crafted PDF during append operations
A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...
pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder
A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted Microsoft Paint MSP image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding RLE decoder expands image da...
pillow: pillow: Denial of Service via duplicate page references in PDF files
A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...
Important: Red Hat Security Advisory: python-pillow security update
An update for python-pillow is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
pillow: Pillow: Denial of Service via unbounded recursion in PDF parser
A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...
ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing
A flaw was found in the ip-address library. A remote attacker can exploit this vulnerability by supplying an excessively large IPv6 address string to an application that parses input without length limits. The parser attempts to process the unbounded input and generate disproportionately large...
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial ...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...
nodejs: nodejs: Permission model bypass via wildcard path matching flaw
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example,...
nodejs: nodejs: predictable random values via snapshot entropy cache reuse
A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt can be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If those APIs or dependents such as...
Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update
An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1, tls.checkServerIdentity may fail to classify the host as an IP address, normalize it to a canonical form, and match...