CVE-2025-37968

CVE-2025-37968 (Linux kernel) affects the iio: light: opt3001 driver. The issue is a deadlock in a threaded IRQ path caused by reading the same flag twice (once for mutex_lock, once for mutex_unlock). The fix standardizes the flag handling by reading it into a local variable and reusing that valu...

CVE-2025-37982

CVE-2025-37982 affects the Linux kernel wifi driver wl1251 (wl1251_tx_work path). The vulnerability is a memory leak: when wl1251_ps_elp_wakeup fails with -ETIMEDOUT, the skb dequeued from tx_queue is lost. The advisory/connected Azure Nessus entry confirms the fix: the skb must be re-queued back...

CVE-2025-38415

CVE-2025-38415 is a Linux kernel vulnerability affecting Squashfs where sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE) can return 0, causing msblk->devblksize to be 0 and leading to an out-of-bounds shift (64) in msblk->devblksize_log2. The issue stems from not handling a 0 return from sb_min_b...

CVE-2007-4772

CVE-2007-4772 concerns the Tcl (Tool Command Language) regular expression parser. The affected code path is TCL before 8.4.17, which, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of servic...

CVE-2011-2501

The CVE-2011-2501 issue in libpng is an off-by-one/ out-of-bounds read vulnerability in png_format_buffer (pngerror.c). A crafted PNG image can trigger a denial of service (application crash) by exploiting the error-message copy path. Affected branches include libpng 1.0.x before 1.0.55, 1.2.x be...

CVE-2012-3150

CVE-2012-3150 is an unspecified vulnerability in the MySQL Server component (Oracle MySQL 5.1.64 and earlier; 5.5.26 and earlier) that allows remote authenticated users to affect availability via unknown vectors related to the Server Optimizer. Impact is described as partial availability degradat...

CVE-2013-3812

CVE-2013-3812 affects Oracle MySQL Server prior to 5.5.31 and 5.6.11, where an unspecified vulnerability in Server Replication allows remote authenticated users to affect availability via unknown vectors. The information explicitly cites availability impact (PARTIAL) but vectors and root cause ar...

CVE-2014-4172

The CVE-2014-4172 issue affects Jasig Java CAS Client (<3.3.2), .NET CAS Client (<1.0.2), and phpCAS (

CVE-2014-4975

CVE-2014-4975 is an off-by-one stack-based buffer overflow in the encodes() function (pack.c) of Ruby 1.9.3 and earlier, and 2.x through 2.1.2, triggered by certain format string specifiers. This can cause a denial of service via segmentation fault. Connected advisories note this Ruby pack() issu...

CVE-2014-9496

CVE-2014-9496 affects libsndfile: the sd2_parse_rsrc_fork function in sd2.c can trigger an out-of-bounds read via an (1) map offset or (2) rsrc marker. Multiple connected advisories confirm this vulnerability in libsndfile and list out-of-bounds reads as the impact. The condition is tied to the s...

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2015-3258

CVE-2015-3258 affects cups-filters' texttopdf component (filter/texttopdf.c). Root cause: a heap-based buffer overflow in WriteProlog when processing a print job with a small line size, allowing a remote attacker to crash texttopdf or possibly execute arbitrary code. Affected product: cups-filter...

CVE-2016-6128

CVE-2016-6128 affects the GD Graphics Library (libgd), specifically the gdImageCropThreshold function in gd_crop.c, with vulnerable pre-2.2.3 releases used by PHP prior to 7.0.9. Exploitation can cause an application crash (denial of service) via an invalid color index. Public advisories and vend...

CVE-2017-12180

CVE-2017-12180 affects xorg-x11-server before 1.19.5 due to missing length validation in XFree86 VidModeExtension, allowing a malicious X client to crash the X server or possibly execute arbitrary code.

CVE-2017-12864

CVE-2017-12864 affects OpenCV (OpenCV 3.3 and earlier). The issue is in opencv/modules/imgcodecs/src/grfmt_pxm.cpp ReadNumber, which did not check input length, enabling an integer overflow when processing remote images and potentially leading to remote code execution or denial of service. Public...

CVE-2017-14169

CVE-2017-14169 affects FFmpeg/libavformat: specifically the mxf_read_primer_pack function in libavformat/mxfdec.c. The description documents an integer signedness error when a crafted MXF file provides a large item_num (e.g., 0xffffffff), causing item_num to become negative and bypassing the chec...

CVE-2017-14175

CVE-2017-14175 is rejected; this candidate is not used and does not represent an active vulnerability.

CVE-2017-15429

The CVE-2017-15429 entry concerns Google Chrome prior to 63.0.3239.108, where an insecure implementation in V8 WebAssembly JS bindings could allow a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected component is the V8 bindings used by Chrome’s WebAssemb...

CVE-2017-3463

CVE-2017-3463 is a vulnerability in the MySQL Server component of Oracle MySQL (Server: Security: Privileges). The MiracleLinux advisories indicate affected MySQL Server instances include 5.5.54 and earlier, 5.6.35 and earlier, and 5.7.17 and earlier. The issue allows a highly privileged attacker...

CVE-2017-5092

CVE-2017-5092 affects Google Chrome on Windows where PPAPI Plugins failed to validate untrusted input, enabling a remote attacker to potentially escape the sandbox through a crafted HTML page. The root cause is insufficient input validation in PPAPI Plugins, leading to sandbox escape. Affected ve...

CVE-2017-7750

CVE-2017-7750 describes a use-after-free in video control operations when a element holds a reference to an older window that has been replaced in the DOM, leading to a potentially exploitable crash. Affected products and versions from the connected records include Mozilla Firefox < 54, Firef...

CVE-2017-8361

The CVE-2017-8361 issue affects libsndfile 1.0.28 and is caused by a flaw in the flac_buffer_copy function (flac.c), enabling a crafted audio file to trigger a denial of service via a buffer overflow. The vulnerability is exploitable remotely and could crash the application; some reports mention ...

CVE-2018-1002200

CVE-2018-1002200 affects plexus-archiver prior to 3.6.0, which is vulnerable to a directory traversal (Zip-Slip) that allows an attacker extracting a crafted archive to write to arbitrary files. Impact observed in multiple advisories: arbitrary file write/overwrite by exploiting zip entry path tr...

CVE-2018-10471

Technical details for CVE-2018-10471 are not provided in the connected documents. Monitor for updates from Xen security advisories and vendor/maintainer advisories for affected versions and fixes.

CVE-2018-10958

CVE-2018-10958 affects Exiv2 0.26 where a large size value can cause a SIGABRT during memory allocation in Exiv2::Internal::PngChunk::zlibUncompress. Connected advisories list this CVE among Exiv2 issues and describe the crash path; no explicit patch version is stated for this CVE in the provided...

CVE-2018-20360

FAAD2 (libfaad) vulnerability CVE-2018-20360 arises from an invalid memory address dereference in sbr_process_channel (libfaad/sbr_dec.c), on FAAD2 2.8.8, causing segmentation fault and denial of service. Connected advisories confirm this issue among multiple FAAD2 CVEs and document patches acros...

CVE-2018-5268

CVE-2018-5268 - OpenCV 3.3.1 risk detail : OpenCV 3.3.1 contains a heap-based buffer overflow in cv::Jpeg2KDecoder::readComponent8u, triggered when parsing a crafted image file in modules/imgcodecs/src/grfmt_jpeg2000.cpp. The vulnerability stems from parsing JPEG 2000 data and may lead to memory ...

CVE-2018-5336

The CVE-2018-5336 issue affects Wireshark, specifically versions 2.4.0–2.4.3 and 2.2.0–2.2.11. The JSON, XML, NTP, XMPP, and GDB dissectors could crash due to excessive recursion. The vulnerability was fixed by limiting recursion in epan/tvbparse.c. No exploits are documented in the provided sour...

CVE-2018-6035

CVE-2018-6035 concerns insufficient isolation of DevTools from extensions in Chromium/Google Chrome, enabling a crafted extension to potentially leak local user data. Affected product: Google Chrome (Chromium base). Root cause: insufficient policy enforcement in DevTools that allows extension int...

CVE-2018-6109

CVE-2018-6109 affects Google Chrome/Chromium: the File API readAsText() could read the user-selected file repeatedly instead of once, allowing data exposure via a crafted HTML page on Chrome versions prior to 66.0.3359.117. Public advisories (e.g., Debian security notices) confirm a fix was relea...

CVE-2018-6163

CVE-2018-6163 is a URL spoofing vulnerability in Google Chrome’s Omnibox caused by incorrect handling of confusable characters in the URL Formatter, allowing a remote attacker to trick users with IDN homographs. Affected product/version: Google Chrome (Omnibox) prior to 68.0.3440.75. Impact: doma...

CVE-2018-6164

CVE-2018-6164 relates to Google Chrome/Chromium’s Blink component. The initial CVE description notes “insufficient origin checks for CSS content in Blink” which allowed a remote attacker to leak cross-origin data via a crafted HTML page. Connected documents corroborate a broader class of cross-or...

CVE-2018-7337

CVE-2018-7337 affects Wireshark 2.4.0–2.4.4, where the DOCSIS protocol dissector could crash. The root cause was a recursive algorithm used for concatenated PDUs in plugins/docsis/packet-docsis.c. The issue was addressed by removing that recursive approach, mitigating the crash vector. Connected ...

CVE-2018-9263

Wireshark CVE-2018-9263 affects Kerberos dissector: versions 2.4.0–2.4.5 and 2.2.0–2.2.13 could crash. Root cause: insufficient key length check in Kerberos dissector; fixed in epan/dissectors/packet-kerberos.c by ensuring a nonzero key length. Remediation: upgrade to a fixed release (e.g., Wires...

CVE-2019-11454

CVE-2019-11454 affects Monit before 5.25.3, with a persistent cross‑site scripting (XSS) flaw in http/cervlet.c that could be triggered via an unsanitized user field in the Authorization header during an _viewlog operation. Connected advisories show multiple distributions addressing this with fix...

CVE-2019-3795

CVE-2019-3795 affects Spring Security: insecure randomness when SecureRandomFactoryBean#setSeed is used to configure a SecureRandom. Impact requires the application to supply a seed and expose the resulting random material to an attacker. Affected releases include Spring Security 4.2.x before 4.2...

CVE-2021-3935

CVE-2021-3935 affects PgBouncer when configured to use certificate authentication. A man-in-the-middle can inject arbitrary SQL queries at the first connection, even with TLS verification, in versions prior to 1.16.1. The root cause is not detailed in the initial document, but multiple connected ...

CVE-2021-4063

CVE-2021-4063 is a Use-After-Free vulnerability in the Chromium browser engine’s Developer Tools before version 96.0.4664.93. The issue, described across multiple trusted sources, can allow a remote attacker to potentially cause heap corruption via a crafted HTML page, with impact including arbit...

CVE-2021-42717

CVE-2021-42717 affects ModSecurity 3.x up to 3.0.5 (and 2.x up to 2.9.4). The flaw: excessive nesting of JSON objects causes severe resource exhaustion (DoS), with small-ish requests (e.g., ~300 KB) able to tie up workers and consume CPU. Mitigations documented across multiple sources include upg...

CVE-2022-1923

CVE-2022-1923 affects the GStreamer gst-plugins-good1.0 demuxer for MKV files using bz2 decompression. The issue is a heap overwrite/segfault caused by an integer overflow in the matroskademux element when processing bzip decompression, with impact depending on the libc and OS (heap overwrite pos...

CVE-2022-26364

CVE-2022-26364 is one of multiple Xen vulnerabilities described in advisories (e.g., GLSA-202208-23, SUSE/Security updates) affecting Xen on x86 PV guests. The issue stems from CPU cache non-coherency interactions with Xen’s page/typeref safety checks, which can cause a guest to incorrectly belie...

CVE-2022-30783

CVE-2022-30783 affects NTFS-3G (libfuse-lite) via an invalid return code in fuse_kern_mount, enabling interception of libfuse-lite protocol traffic between NTFS-3G and the kernel. The issue exists in NTFS-3G up to 2021.8.22; multiple connected advisories note the vulnerability and provide remedia...

CVE-2022-40188

CVE-2022-40188 affects Knot Resolver prior to version 5.5.3. The issue is a remote denial-of-service via CPU consumption caused by algorithmic complexity when an attack results in large nameserver or address sets being returned by an authoritative server. Public advisories (NVD entry and various ...

CVE-2024-26702

CVE-2024-26702 : In the Linux kernel, the iio: magnetometer RM3100 driver added a boundary check for the value read from RM3100_REG_TMRC to prevent an out-of-bounds access that could crash rm3100_common_probe. The crash was caused by out-of-bounds access of the rm3100_samp_rates array due to hard...

CVE-2024-35935

CVE-2024-35935 – Linux kernel (btrfs: send: handle path ref underflow in header iterate_inode_ref()) Connected documents confirm a concrete fix in the Linux kernel: when building a path buffer for iterate_inode_ref(), a BUG_ON-based path underflow handling was replaced with proper error handling ...

CVE-2025-37773

CVE-2025-37773 : In the Linux kernel, the virtiofs subsystem was updated to fix a NULL source-name in the filesystem context source name check. In fuzzing-like scenarios, the source name may be NULL, potentially triggering a kernel panic. The connected advisories confirm the issue and describe th...

CVE-2025-37852

CVE-2025-37852 affects the Linux kernel DRM/AMDGPU stack. The root cause is errors from amdgpu_cgs_create_device() in amd_powerplay_create(), which could lead to a null pointer dereference if not handled. The fix propagates the failure to the caller, releases the hwmgr, and returns -ENOMEM instea...

CVE-2025-38180

Summary: CVE-2025-38180 affects the Linux kernel’s ATM /proc net handling (lec). The root cause is unsafe dev_lec[] changes paired with missing dev_hold() before dev_put(), causing an imbalance and use-after-free (UAF). The issue is tied to the net/atm/lec handling code and has been addressed by ...

CVE-2008-2108

CVE-2008-2108 affects PHP 4.x prior to 4.4.8 and PHP 5.x prior to 5.2.5 on 64-bit systems. The GENERATE_SEED macro’s precision loss during 64-bit multiplication yields only 24 bits of entropy, making brute‑force attacks against protections using rand/mt_rand easier. The issue is fixed in the adve...

CVE-2010-3477

The CVE-2010-3477 issue affects the Linux kernel’s net/sched/act_police.c (tcf_act_police_dump) in versions before 2.6.36-rc4. The root cause is incomplete initialization of certain structure members during dump operations, allowing local users to read potentially sensitive kernel memory. The vul...