CVE-2023-33460

CVE-2023-33460 involves a memory leak in the yajl JSON library (yajl_tree_parse) that can cause out-of-memory conditions and server crashes for the affected 2.1.0 release. Connected advisories confirm patches by various distributions (e.g., Debian, AlmaLinux, Amazon Linux, CBL-Mariner, Astra Linu...

CVE-2019-17666

CVE-2019-17666 affects the Linux kernel Realtek rtlwifi driver (rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c). The root cause is a missing upper-bound check that leads to a buffer overflow. Impact stated in sources includes memory corruption and potential remote code execution, wit...

CVE-2014-0196

CVE-2014-0196 affects the Linux kernel (through 3.14.3) specifically the n_tty_write function in drivers/tty/n_tty.c. The flaw permits a local user to trigger a race condition between read and write operations with long strings in the LECHO & !OPOST case, enabling denial of service (memory corrup...

CVE-2018-10858

The connected documents confirm CVE-2018-10858 is a heap-buffer overflow in Samba client handling of extra-long filenames in directory listings, enabling arbitrary code execution on a Samba client. Affected versions include Samba before 4.6.16, 4.7.9, and 4.8.4. Mitigation/patches: updates to fix...

CVE-2020-14323

Affects Samba Winbind in Samba; root cause is a null pointer/invalid lookupsids path leading to a crash and DoS. Affected versions are prior to 4.11.15, prior to 4.12.9, and prior to 4.13.1. Remediation is to upgrade to a fixed Samba release (e.g., 4.13.x line such as 4.13.3 per AlmaLinux advisor...

CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2022-31081

CVE-2022-31081 affects the Perl HTTP::Daemon library. Versions prior to 6.15 are vulnerable due to improper handling of the Content-Length header, which could enable HTTP request smuggling and potentially allow privileged access to APIs or poisoning of intermediate caches. The issue is documented...

CVE-2020-10713

CVE-2020-10713 affects GRUB2 prior to 2.06. The flaw allows an attacker to hijack/tamper the GRUB verification process and bypass Secure Boot, enabling arbitrary code execution during boot when a crafted grub.cfg is processed. Exploitation requires local access or access to modify boot/network se...

CVE-2019-14540

CVE-2019-14540 affects jackson-databind up to version 2.9.10 with serialization gadget risk involving the HikariCP classes (com.zaxxer.hikari.HikariConfig). The authoritative initial doc notes a polymorphic typing issue in jackson-databind related to HikariConfig. Connected-material references (A...

CVE-2022-0194

Netatalk (vulnerable component: ad_addcomment) is affected by CVE-2022-0194. The flaw stems from improper validation of user-supplied data length before copying into a fixed-size stack buffer, enabling an unauthenticated attacker to execute arbitrary code with root privileges on affected installa...

CVE-2020-12888

CVE-2020-12888 affects the Linux kernel VFIO PCI driver (through 5.6.13) and arises from improper handling of accesses to disabled MMIO space. A local attacker or a guest VM with VFIO access could trigger a denial of service or crash by exploiting writes/reads to disabled memory regions. Connecte...

CVE-2023-4428

CVE-2023-4428 affects Chromium-based browsers (Chrome/Chromium) and relates to an out-of-bounds memory access in CSS that could allow a remote attacker to read memory via a crafted HTML page. The issue is classified with high severity and a network attack vector, with user interaction required. T...

CVE-2019-15505

CVE-2019-15505 affects the technisat-usb2 media driver in Linux kernels up to 5.2.9. The issue arises from improper validation of incoming IR packets, leading to a heap buffer over-read. An attacker capable of adding USB devices (potentially via remote USB technologies like usbip/usbredir) could ...

CVE-2020-13934

CVE-2020-13934 affects multiple Apache Tomcat releases (8.5.1–8.5.56, 9.0.x, 10.0.x up to M6) where an h2c direct connection didn’t release the HTTP/1.1 processor after upgrading to HTTP/2, potentially causing OutOfMemoryError and denial of service. Public advisories across vendors and distributi...

CVE-2020-7595

CVE-2020-7595 affects libxml2, specifically the xmlStringLenDecodeEntities function in parser.c of version 2.9.10, which can enter an infinite loop in certain end-of-file situations. Several connected advisories (e.g., ASA-202011-15) corroborate the issue and describe the impact as potential deni...

CVE-2021-29650

CVE-2021-29650 affects the Linux kernel prior to 5.11.11. The netfilter subsystem (net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h) may omit a full memory barrier when a new table value is assigned, enabling a local attacker to trigger a DoS/panic in netfilter. The issue is docume...

CVE-2022-21664

CVE-2022-21664 concerns WordPress across multiple advisories. The issue arises from improper sanitization in a WordPress class, which could enable unintended SQL queries. The vulnerability is mitigated by WordPress patch 5.8.3, with older affected versions fixed via security releases back to 4.1....

CVE-2022-35252

CVE-2022-35252 affects curl’s handling of cookies containing control codes; when such cookies are echoed back to a server, the server may return 400 responses, effectively enabling a “sister site” to deny service to other siblings. Public advisories confirm this is fixed in curl updates across se...

CVE-2023-36478

CVE-2023-36478 (Jetty) affects Jetty 9.x/10.x/11.x: an integer overflow in MetaDataBuilder.checkSize can cause HPACK header lengths to overflow, potentially enabling a remote denial-of-service via malformed HTTP/2 header values. The flaw occurs when length is large and Huffman encoding is used, c...

CVE-2018-10545

Technical details (affected products, versions, exploit information, and fixes) are not provided in the supplied documents. Please monitor for updates.

CVE-2022-36227

CVE-2022-36227 affects libarchive (before 3.6.2). The bug is a NULL pointer dereference caused by not checking the result of calloc, which can return NULL and lead to dereference. Some sources acknowledge that this could in rare circumstances permit arbitrary code execution if NULL is treated as ...

CVE-2017-11103

CVE-2017-11103 affects Heimdal (Kerberos); vulnerability arises from improper handling of the KDC-REP service name in krb5_extract_ticket, enabling remote service impersonation when the unencrypted service name is used instead of the encrypted enc_part. Apple’s security content (HT208112/HT208221...

CVE-2022-39260

Git Shell command-argument parsing bug (CVE-2022-39260) in pre-2.30.6…2.37.4 allows an attacker with SSH access to a Git shell login to overflow an int-based count when building the argv array, enabling arbitrary heap writes and potential remote code execution via execv(). Affected setups require...

CVE-2023-2828

CVE-2023-2828 concerns the BIND 9 DNS server’s named component. The vulnerability stems from the cache-cleaning logic: when the resolver is queried for specific RRsets in a certain order, the configured max-cache-size can be exceeded, potentially causing memory exhaustion. Affected are multiple B...

CVE-2021-29154

CVE-2021-29154 affects the Linux kernel BPF JIT implementation (arch/x86 net/bpf_jit_comp.c and bpf_jit_comp32.c). Connected advisories (e.g., ALAS2KERNEL-5.4-2022-003) confirm a local privilege escalation due to incorrect computation of branch displacements in the BPF JIT, enabling arbitrary cod...

CVE-2021-3537

Summary: CVE-2021-3537 affects libxml2 up to 2.9.11. In XML mixed content parsing, errors were not propagated, causing a NULL dereference when an untrusted document is parsed in recovery mode and post-validated, with availability as the highest impact. The connected documents confirm the vulnerab...

CVE-2018-10549

PHP contains an out-of-bounds read in exif_read_data() (ext/exif/exif.c) when parsing crafted JPEG data due to MakerNote handling lacking a final '\0' character. Affected are PHP 5.6.x up to 5.6.36, 7.0.x up to 7.0.30, 7.1.x up to 7.1.17, and 7.2.x up to 7.2.5. Impact: potential reads beyond boun...

CVE-2023-40167

CVE-2023-40167 (Jetty) affects Jetty Java-based web server/servlet engine. Prior to Jetty 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts a "+" character before the Content-Length in HTTP/1 header fields, which is non-RFC compliant. This could enable request smuggling in scenarios where a dow...

CVE-2021-22543

CVE-2021-22543 is described in connected advisories as a local privilege-escalation through KVM and improper handling of VM_IO|VM_PFNMAP VMAs, which can bypass RO checks and allow reading/writing guest memory by a privileged VM operator. Technical details across sources indicate the vulnerability...

CVE-2019-14835

The CVE-2019-14835 entry describes a buffer overflow in Linux kernel vhost functionality (virtqueue buffers translated to IOVs) during VM live migration. A privileged guest user could pass descriptors with invalid length while migration is underway, potentially causing a host privilege escalation...

CVE-2021-33034

CVE-2021-33034 is a use-after-free in Linux kernel before 5.12.4 in net/bluetooth/hci_event.c when destroying an hci_chan, enabling arbitrary writes. Affected: Linux kernel before 5.12.4 (Bluetooth HCI driver). Mitigation: upgrade to 5.12.4 or later (ChangeLog-5.12.4).

CVE-2022-3564

CVE-2022-3564 is a high-severity Linux kernel vulnerability involving a use-after-free in the Bluetooth subsystem, specifically the function l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c . Connected advisories (CentOS, AlmaLinux, AlmaLinux-RT, Astra Linux, and others) confirm the same weak...

CVE-2018-1000156

GNU patch through 2.7.6 is vulnerable to arbitrary command execution when applying ed-style patches. The root cause is insufficient sanitization of the input patch stream, allowing a crafted patch file to cause patch to pass ed-script commands to the editor. This can enable code execution under t...

CVE-2018-1057

CVE-2018-1057 affects Samba in AD DC setups where the LDAP server incorrectly validates permissions to modify passwords, enabling authenticated users to change other users’ passwords (including admin/privileged accounts). Affected: Samba 4 AD DC; impact is password modification rights over LDAP. ...

CVE-2018-14647

CVE-2018-14647 affects Python’s elementtree C accelerator, which failed to initialize Expat’s hash salt. This can enable denial-of-service attacks by triggering pathological hash collisions in Expat’s internal structures, consuming CPU and RAM. Affected versions include Python 3.7.0, 3.6.0–3.6.6,...

CVE-2022-25236

CVE-2022-25236 (Expat/libexpat) affects Expat before 2.4.5, where attackers can insert namespace-separator characters into namespace URIs in xmlparse.c. The issue can enable attacker-controlled input to trigger a denial of service or, in certain contexts (e.g., misuse of xmlns[:prefix] attribute ...

CVE-2019-12519

CVE-2019-12519 in Squid (up to 4.7) originates from ESI handling: ESIExpression::Evaluate uses a fixed stack buffer and does not check for overflow when adding a new member, causing a stack/heap overflow under certain expressions and potentially impacting confidentiality, integrity, and availabil...

CVE-2019-13132

CVE-2019-13132 concerns ZeroMQ libzmq: a remote, unauthenticated client connecting to a libzmq app with a CURVE-enabled listening socket can trigger a stack/buffer overflow in the library, for libzmq versions up to just before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2. Public servers runn...

CVE-2022-29155

OpenLDAP CVE-2022-29155 affects OpenLDAP 2.x prior to 2.5.12 and 2.6.x prior to 2.6.2. The vulnerability resides in the experimental back-sql backend used by slapd, where an LDAP search may process a SQL statement without proper escaping in the search filter. The underlying issue is SQL injection...

CVE-2024-1086

CVE-2024-1086 is a use-after-free in Linux kernel nf_tables (netfilter). The vulnerability stems from nft_verdict_init() allowing positive values as drop errors in the hook verdict, enabling nf_hook_slow() to trigger a double-free when NF_DROP is issued with a drop error resembling NF_ACCEPT. Exp...

CVE-2019-11036

CVE-2019-11036 involves a heap-based buffer over-read in the PHP EXIF extension when processing EXIF data, potentially allowing information disclosure or a crash. The connected advisories confirm this issue and related EXIF problems (CVE-2019-11034, CVE-2019-11035, CVE-2019-11036, CVE-2019-11038–...

CVE-2019-14821

CVE-2019-14821 is a Linux kernel KVM issue: an out-of-bounds access in the Coalesced MMIO write path can occur if a host user controls the MMIO ring buffer indices (ring->first/ring->last). A local attacker with /dev/kvm access could crash the host kernel or potentially escalate privileges ...

CVE-2021-41183

CVE-2021-41183 concerns jQuery-UI’s Datepicker in the embedded jQuery-UI copy used by OTRS (notably in the 1.12.1 series). The vulnerability arises from accepting values for the various *Text options from untrusted sources, which could allow execution of untrusted code. The issue is fixed in jQue...

CVE-2023-5363

CVE-2023-5363 : OpenSSL 3.0 and 3.1 are affected by a bug in key/IV length processing during EVP_Init_ex2/2 and EVP_CipherInit_ex2, where alterations to keylen/ivlen via OSSL_PARAM may not apply, causing truncation or overruns. This can yield non-unique IVs and, in CCM/GCM/OCB modes, potential lo...

CVE-2017-3145

CVE-2017-3145 affects BIND: the resolver incorrectly sequenced cleanup operations on upstream recursion fetch contexts, causing a use-after-free that can trigger an assertion failure and crash named. Affected versions include BIND 9.0.0 through 9.8.x, 9.9.0–9.9.11, 9.10.0–9.10.6, 9.11.0–9.11.2, 9...

CVE-2020-14812

CVE-2020-14812 affects Oracle MySQL Server (component: Server: Locking) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. Exploitation can lead to a hang or frequent crashes (DoS) with network access. Remediation status varies by distribution; Debian LTS notes a fix...

CVE-2020-27840

CVE-2020-27840 affects Samba. The flaw is a heap corruption vulnerability caused by spaces in a domain-name DN string, which can cause an out-of-bounds write and crash the process. Impact is primarily availability. Public details show Samba package variants (e.g., Samba 4.12.5-7) and notes that u...

CVE-2021-33037

CVE-2021-33037 affects Apache Tomcat: versions 10.0.0-M1–10.0.6, 9.0.0.M1–9.0.46, and 8.5.0–8.5.66 may mishandle the HTTP transfer-encoding header with reverse proxies, enabling request smuggling. Root cause: improper header handling allowing spoofed content encoding sequencing. Impact stated in ...

CVE-2019-3855

CVE-2019-3855 is a libssh2 integer overflow in the transport read path that may cause an out-of-bounds write when processing server packets. The issue appears in libssh2 prior to 1.8.1 and could enable code exposure or other impact if a user connects to a malicious SSH server. Connected advisorie...

CVE-2022-21661

WordPress CVE-2022-21661 is a WP_Query SQL injection vulnerability in WordPress core that can be triggered via plugins/themes using WP_Query in vulnerable ways. The initial entry notes improper sanitization in WP_Query allows SQL injection, with patches back through WordPress 3.7.37 and a fixed 5...