CVE-2017-5098

CVE-2017-5098 is a use-after-free in V8 (Chromium) prior to 60.0.3112.78, affecting Chrome on Mac, Windows, Linux and Android. This vulnerability allows a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. The connected advisories indicate the fix was released with C...

CVE-2017-9994

CVE-2017-9994 affects FFmpeg’s libavcodec/webp.c where pix_fmt is not reliably set, enabling a crafted file to trigger a heap-based buffer overflow and application crash (denial of service) and possibly other impact. Affected versions include FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before...

CVE-2018-1000179

CVE-2018-1000179 affects Quassel 0.12.4 where a NULL pointer dereference in quasselcore::CoreAuthHandler::handle(const Login&) can cause a denial of service. Multiple advisories confirm the issue; Mageia and Gentoo/GLSA note a fix upgrade path, e.g., to newer Quassel releases (0.12.5) or patched ...

CVE-2018-18353

This CVE refers to Google Chrome/Chromium’s Network Authentication component, where failure to dismiss HTTP auth dialogs on navigation could let a remote attacker confuse the user about the origin of an auto dialog. Connected advisories indicate the issue affects Chromium/Chrome builds before ver...

CVE-2018-9265

Wireshark has a vulnerability CVE-2018-9265: in the tn3270 dissector there is a memory leak affecting Wireshark 2.4.0–2.4.5 and 2.2.0–2.2.13. Advisories indicate this memory-leak issue was fixed in Wireshark 2.2.14 and 2.4.6 (e.g., SUSE openSUSE advisories for 2018:0980/0981 and related notes). A...

CVE-2019-1010069

CVE-2019-1010069 affects moinejf abcm2ps 8.13.20. The vulnerability is an Incorrect Access Control in front.c, function txt_add, enabling a crafted file to cause a denial of service. The fixed version is implemented after commit 08aef597656d065e86075f3d53fda89765845eae. Available references from ...

CVE-2019-17343

CVE-2019-17343 affects Xen up to 4.11.x. An issue in the HVM physmap handling for PV domains allows x86 PV guest OS users to cause a denial of service or privilege escalation. Connected advisories reference Xen/XSA discussions, but the provided documents do not include a patch version or remediat...

CVE-2019-9656

CVE-2019-9656 affects LibOFX 0.9.14, with a NULL pointer dereference in OFXApplication::startElement in lib/ofx_sgml.cpp (as demonstrated by ofxdump). Connected advisories indicate patches exist for libofx to fix this vulnerability (e.g., SUSE/MGASA-2019-0409 and OSV entries). Impact details in t...

CVE-2020-17446

CVE-2020-17446 affects the asyncpg library (Python) prior to version 0.21.0. A crafted server response from a malicious PostgreSQL server can trigger a crash or execute arbitrary code on the database client due to access to an uninitialized pointer in the array data decoder. The connected documen...

CVE-2020-36277

Leptonica before 1.80.0 is vulnerable to a denial-of-service (application crash) via an incorrect left shift in pixConvert2To8 (pixconv.c). The issue is confirmed across multiple advisories (Astra Linux, Mageia, Gentoo GLSA, Fedora) and is mitigated by upgrading to Leptonica 1.80.0 or later. Conn...

CVE-2021-21848

CVE-2021-21848 concerns the GPAC Project on Advanced Content library, version 1.0.1, where the MPEG-4 decoding path can overrun due to reusing the parser for atoms with the stsz code when parsing stz2 atoms. This integer overflow can lead to a heap-based buffer overflow and memory corruption. The...

CVE-2021-21899

CVE-2021-21899 affects LibreCAD/libdxfrw: the heap buffer overflow in dwgCompressor::copyCompBytes21 when parsing crafted .dwg files can lead to code execution. Public advisories indicate multiple distro fixes (Debian DSA-5077, DLA-2838-1; Gentoo GLSA-202305-26; openSUSE/SUSE updates; Ubuntu USN-...

CVE-2021-21900

CVE-2021-21900 : A use-after-free in LibreCAD’s libdxfrw (dxfRW::processLType()) can be triggered by a crafted DXF file (LibreCAD libdxfrw 2.2.0-rc2-19-ge02f3580). Documented in advisories (e.g., GLSA-202305-26, openSUSE openSUSE-SU-2022:0067-1, Debian DSA-5077-1) as a potential for code executio...

CVE-2021-42326

CVE-2021-42326 affects Redmine prior to 4.1.5 and 4.2.x prior to 4.2.3, where an insufficient access filter on activity views may disclose usernames. The root cause is inadequate access control in activity views, enabling information disclosure. Affected products are Redmine (project management/w...

CVE-2021-45088

CVE-2021-45088 is an XSS vulnerability in GNOME Web (Epiphany) exploitable via an error page, affecting Epiphany/GNOME Web up to versions before 40.4 and 41.x before 41.1. Connected sources confirm this CVE as part of multiple GNOME/Epiphany XSS issues and indicate Debian/Mageia advisories with f...

CVE-2022-34674

CVE-2022-34674 affects the NVIDIA GPU Display Driver for Linux, specifically the kernel-mode layer handler where a helper function may map more physical pages than requested. This can cause undefined behavior or information leakage. Public documents consistently describe the issue as a Linux driv...

CVE-2022-36351

Technical details for CVE-2022-36351 are not publicly available in the provided documents. Monitor for updates.

CVE-2022-36354

CVE-2022-36354 is a heap out-of-bounds read in OpenImageIO’s RLA format parser (master-branch 9aeece7a and v2.3.19.0). A malformed RLA file can cause an out-of-bounds read of heap metadata, potentially leaking sensitive information. Connected advisories confirm practical exposure and publicly ava...

CVE-2022-42312

CVE-2022-42312 is a Xenstore/xenstored memory‑consumption vulnerability. The connected advisories describe multiple stonewalling vectors that can make xenstored allocate large amounts of memory, leading to Denial of Service (DoS): issuing requests without reading responses (buffering in memory), ...

CVE-2023-39356

CVE-2023-39356: FreeRDP contains a missing offset validation in gdi_multi_opaque_rect. The boundary check for multi_opaque_rect->numRectangles is absent, enabling an Out-Of-Bounds Read that can crash the client. Documents specify this issue is addressed in versions 2.11.0 and 3.0.0-beta3. The ...

CVE-2024-37384

CVE-2024-37384 affects Roundcube Webmail: versions before 1.5.7 and 1.6.x before 1.6.7 are vulnerable. The issue allows Cross-Site Scripting via list columns from user preferences. The connected documents include Debian/Ubuntu/Nessus and OpenVAS advisories that corroborate the vulnerability and i...

CVE-2025-38200

Technical details about CVE-2025-38200 are not provided in the supplied documents. The initial entry mentions a Linux kernel MMIO underflow fix but contains no product/vendor/version specifics beyond kernel change. Monitor for updates.

CVE-2025-38204

CVE-2025-38204 affects the Linux kernel’s JFS filesystem. The issue is an array-index-out-of-bounds read in add_missing_indices, where stbl (s8) must map to offsets 0–127. A bound check was added and -EIO is returned if the check fails; jfs_readdir is also updated to propagate errors from add_mis...

CVE-2025-38300

CVE-2025-38300: In the Linux kernel sun8i-ce-cipher path (sun8i_ce_cipher_prepare), two DMA cleanup issues on the error path are fixed. 1) On the theend_sgs error path, dma_unmap is now performed only if the corresponding dma_map_sg() succeeded for areq->dst. 2) On the theend_iv path, dma_unma...

CVE-2025-38384

CVE-2025-38384 affects the Linux kernel’s MTD spinand/ECC engine path. The root cause is a memory leak where ECC engine configuration memory allocated during ECC init is not released during spinand cleanup. The leak trace shows kmemleak reporting an unreferenced object during spinand probe/init p...

CVE-2025-38401

The CVE-2025-38401 issue affects the Linux kernel’s mtk-sd driver, where a DMA map failure in msdc_prepare_data() could lead to memory corruption if data DMA is started with stale settings. The vulnerability’s description and related advisories (including Debian LTS DLA entries and Amazon Linux A...

CVE-2002-0062

CVE-2002-0062 is a local privilege-escalation in ncurses 5.0 and the ncurses4 compatibility package, caused by a buffer overflow in routines for moving the physical cursor and scrolling. Debian and Red Hat advisories describe the issue and assign CAN-2002-0062. Affected products include ncurses 5...

CVE-2007-3998

The CVE-2007-3998 issue affects the PHP wordwrap function: in PHP 4 prior to 4.4.8 and PHP 5 prior to 5.2.4, breakcharlen is not used correctly, which can trigger a divide-by-zero condition and cause a denial of service through crafted arguments (e.g., chr(0), 0, ""). Affected versions are explic...

CVE-2008-2812

CVE-2008-2812 affects the Linux kernel prior to 2.6.25.10, with NULL pointer dereferences in tty handling (notably in drivers/net/ such as hamradio, irda, ppp, slip, wan, and wireless components) potentially enabling local privilege escalation or a system crash. The issue arises from missing chec...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2008-5500

CVE-2008-5500 affects Mozilla Firefox 3.x before 3.0.5 and Firefox 2.x before 2.0.0.19, Mozilla Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14. The vulnerability arises from the layout engine when processing malformed content, allowing a remote attacker to cause a denial of serv...

CVE-2010-0159

CVE-2010-0159 affects Mozilla-based browsers including Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The vulnerability arises from memory-corruption in layout handling, specifically in nsBlockFrame::StealFrame and related vectors, al...

CVE-2010-0298

Summary: CVE-2010-0298 affects the x86 emulator in KVM 83, where CPL/IOPL checks are not applied to CPL3 memory accesses, enabling a guest OS user to crash the guest or gain privileges via an IO port or MMIO region (related to CVE-2010-0306). What is affected: KVM/x86 emulator code in affected Li...

CVE-2010-3297

CVE-2010-3297 affects the Linux kernel net/eql driver; the eql_g_master_cfg function in drivers/net/eql.c did not initialize a structure member, enabling local users to read kernel stack memory via an EQL_GETMASTRCFG ioctl. Affects kernels before 2.6.36-rc5; corrected in subsequent patches (net/e...

CVE-2010-3298

CVE-2010-3298 affects the Linux kernel. The hso_get_count function in drivers/net/usb/hso.c, in kernel builds before 2.6.36-rc5, does not initialize a certain structure member, which allows local users to read potentially sensitive information from kernel stack memory via the TIOCGICOUNT ioctl. T...

CVE-2011-4120

The CVE-2011-4120 entry concerns the Yubico PAM Module prior to version 2.10. The vulnerability arises when the PAM module is configured as 'sufficient' and the 'use_first_pass' option is not used; under these conditions a remote attacker can authenticate by supplying a NULL password (pressing Ct...

CVE-2014-1829

The CVE-2014-1829 entry describes a vulnerability in Requests (python-requests) prior to version 2.3.0, where a redirected request could reveal a netrc password by reading the Authorization header. The core issue is exposure of credentials through netrc data via headers during redirects. Affected...

CVE-2014-3532

dbus CVE-2014-3532 affects dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 when run on Linux 2.6.37-rc4 or later. The flaw lets local attackers cause a denial of service by sending a message containing a file descriptor and then exceeding the maximum recursion depth before the initial message is ...

CVE-2014-3533

CVE-2014-3533 affects the D-Bus project (dbus) components where dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allow local users to cause a denial of service by sending a crafted sequence that leads the dbus-daemon to forward a message containing an invalid file descriptor. The impact is a local...

CVE-2014-9671

CVE-2014-9671Affected software: FreeType before 2.5.4. Root cause: An off-by-one error in pcf_get_properties (pcf/pcfread.c) allows a crafted PCF file with a 0xffffffff size value that is improperly incremented, leading to a NULL pointer dereference. Impact: Remote attacker could cause a denial o...

CVE-2015-1255

CVE-2015-1255 affects Google Chrome up to version 43.0.2357.65 in the WebAudio capturer path (content/renderer/media/webaudio_capturer_source.cc). The vulnerability is a use-after-free that can enable a remote attacker to cause a denial of service via heap memory corruption, triggered by improper...

CVE-2015-1263

The CVE-2015-1263 entry concerns Google Chrome and its Spellcheck API: the Hunspell dictionary download was not performed over HTTPS, enabling potential MITM manipulation of spelling suggestions. Connected records corroborate the same issue for CVE-2015-1288 (and related Debian security advisorie...

CVE-2015-3219

CVE-2015-3219 is a cross-site scripting (XSS) vulnerability in OpenStack Horizon’s Horizon Orchestration/Stack UI. The flaw allows an attacker to inject script via the description parameter in a heat template, due to improper handling in the Field class’s help_text. Affected: OpenStack Dashboard ...

CVE-2015-7312

CVE-2015-7312 affects the Linux kernel 3.x/4.x via race conditions in the aufs aufs3-mmap.patch and aufs4-mmap.patch patches. The vulnerability allows local users to cause denial of service (use-after-free/BUG) or potentially gain privileges through madvise or msync calls, related to mm/madvise.c...

CVE-2016-10243

CVE-2016-10243 affects TeX Live: the mpost component can be invoked via shell_escape_commands in texmf.cnf, enabling remote command execution. The vulnerability arises from including mpost in shell_escape_commands, allowing a remote attacker to run arbitrary commands when TeX Live processes craft...

CVE-2016-1659

CVE-2016-1659 is part of the Chromium/Google Chrome 50.0.2661.75 update (20 security fixes total). The Chrome release notes attribute CVE-2016-1659 to “various fixes from internal audits, fuzzing and other initiatives.” The connected documents indicate this CVE is addressed alongside other issues...

CVE-2016-8863

CVE-2016-8863 affects the Portable UPnP SDK (libupnp) before 1.6.21. The heap-based overflow occurs in create_url_list (gena/gena_device.c) when processing a valid URI followed by an invalid one in the CALLBACK header of a SUBSCRIBE request. This can lead to a crash or potentially arbitrary code ...

CVE-2017-11409

The CVE-2017-11409 entry concerns Wireshark versions 2.0.0–2.0.13, where the GPRS LLC dissector could enter a large loop. The root cause, as documented, is an inappropriate integer data type used in the dissector implementation (epan/dissectors/packet-gprs-llc.c). The impact described is a potent...

CVE-2017-12102

CVE-2017-12102 refers to an exploitable integer overflow in Blender 2.78c where the conversion of curves to polygons can overflow, potentially causing a buffer overflow and code execution when a user opens a crafted .blend file or uses it as a library. Public records note this vulnerability along...

CVE-2017-15424

Google Chrome Omnibox vulnerability CVE-2017-15424: insufficient policy enforcement allows domain spoofing via IDN homographs in crafted domain names, affecting versions prior to 63.0.3239.84. Debian and other advisories indicate fix to 63.0.3239.84-1~deb9u1 and related patches; upgrade to 63.0.3...