CVE-2025-38305

CVE-2025-38305 affects the Linux kernel: the advisory describes removing the ptp->n_vclocks check logic in ptp_vclock_in_use() to avoid a recursive locking scenario. The trigger involves reading ptp->n_vclocks under the n_vclocks_mux while another path holds the same mutex, causing a potent...

CVE-2025-38312

CVE-2025-38312 concerns the Linux kernel fbdev path: fbcvt. In fb_find_mode_cvt(), if mode->refresh equals 0x80000000, cvt.f_refresh overflows when doubled, and is subsequently used as a divider in fb_cvt_hperiod(), causing a division by zero and potential kernel oops. The vulnerability is res...

CVE-2025-38555

The CVE CVE-2025-38555 is a use-after-free in Linux kernel USB gadget driver during composite_dev_cleanup, arising when configfs_composite_bind() frees cdev->os_desc_req on kmalloc failure but doesn’t NULL it, leading to a subsequent use of non-NULL pointer. The issue affects the usb gadget’s ...

CVE-2004-1051

Technical details about CVE-2004-1051 are not publicly available in the provided documents. Monitor for updates as new information may be published.

CVE-2006-4093

CVE-2006-4093 affects Linux kernel 2.x on PowerPC PPC970: HID0 attention enable at boot time can crash the kernel (denial of service). Vulnerable: 2.6.x up to 2.6.17.9 and 2.4.x up to 2.4.33.1. Exploitation details are not provided in the initial documents, but multiple advisories (e.g., RHSA, SU...

CVE-2008-2725

CVE-2008-2725 is an integer overflow in Ruby’s rb_ary_splice (and related issues in rb_ary_splice) affecting Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22. The vulnerability can trigger memory corruption via unspecified vectors in context-dep...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-6655

CVE-2012-6655 affects AccountService (accountsservice) 0.6.37, where a flaw in the user_change_password_authorized_cb() function in user.c could allow a local user to obtain encrypted passwords. The connected records confirm the vulnerable component and the root cause, but do not provide a vendor...

CVE-2013-4357

CVE-2013-4357 affects the eglibc package prior to 2.14, where getaddrinfo() is mishandled. This can allow a network-based attacker to cause a denial of service (availability impact: HIGH per CVSSv3.1; base score 7.5). Root cause: incorrect handling in getaddrinfo(). No explicit mitigation or patc...

CVE-2013-4494

Xen vulnerability CVE-2013-4494 is documented in connected materials as affecting Xen in Linux kernels up to 4.3.x, where page_alloc_lock and grant_table.lock are not taken in the same order. This misordering allows local guest administrators with access to multiple vCPUs to trigger a denial of s...

CVE-2013-6474

CVE-2013-6474 is a heap-based buffer overflow in the pdftoopvp filter within CUPS/cups-filters that allows remote code execution via a crafted PDF. Affected: cups-filters (and CUPS components) prior to version 1.0.47. Impact: arbitrary code execution with lp user privileges as described in the CV...

CVE-2014-1609

CVE-2014-1609 affects MantisBT up to version 1.2.15 (pre-1.2.16); multiple SQL injection vectors arise via unsafely constructed parameters to functions such as mc_project_get_attachments, news_get_limited_rows, summary_print_by_enum/age/developer/reporter/category, plugin graph APIs, and certain ...

CVE-2014-5008

CVE-2014-5008: Snoopy in Nagios could allow remote command execution due to an incomplete fix related to escaping in the Snoopy library. Public advisories (Red Hat RHSA-2017-0214, IBM PowerKVM bulletin, Debian DLA-357-1, Amazon ALAS-2017-899) associate the issue with Nagios/Snoopy and provide upd...

CVE-2014-7154

CVE-2014-7154 affects Xen 4.0.0–4.4.x, with a race condition in HVMOP_track_dirty_vram that fails to ensure the guarding lock for dirty video RAM tracking. This can allow certain local guest domains to cause a denial of service via unspecified vectors. The provided documents identify the affected...

CVE-2014-9762

CVE-2014-9762 affects imlib2 before 1.4.7; GIF images without a colormap can trigger a denial of service (segfault). Connected advisories (openSUSE, Gentoo GLSA, Debian DSA, Ubuntu USN) confirm the issue and show remediation by upgrading imlib2 to a newer release (e.g., openSUSE-2016-600 patches ...

CVE-2015-1282

CVE-2015-1282 refers to multiple use-after-free vulnerabilities in pdfium (fpdfsdk/src/javascript/Document.cpp) used by Google Chrome before 44.0.2403.89. The underlying issue affects the Document::delay and Document::DoFieldDelay paths, allowing a remote attacker to cause a denial of service or ...

CVE-2015-3333

CVE-2015-3333 affects Google V8 before 4.2.77.14 as used by Google Chrome before 42.0.2311.90. The vulnerability family could cause a denial of service or other impact via unknown vectors. Public advisories (Debian/Ubuntu) indicate fixes in chromium-browser versions around 42.0.2311.90. No exploi...

CVE-2015-3336

CVE-2015-3336 (Chromium/Google Chrome) : A vulnerability in Chrome/Chromium allowed user-assisted remote attackers to cause UI disruption by abusing CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK. A crafted HTML document loaded via a file: URL could trigger requestFullScreen...

CVE-2015-8949

CVE-2015-8949 is a use-after-free vulnerability in the MySQL driver for Perl (DBD::mysql) affecting versions before 4.033_01, triggered by a faulty path in the my_login flow that allows an unspecified impact. The issue is noted in multiple advisories and CVE lists, with references across NVD, Gen...

CVE-2016-1232

The CVE-2016-1232 issue affects Prosody’s mod_dialback in versions before 0.9.9, where dialback secret tokens were generated with a weak PRNG. This vulnerability can enable spoofing of server-to-server connections via brute force. The Fedora/Debian advisories reference a fix in Prosody 0.9.9 (and...

CVE-2016-1243

CVE-2016-1243 describes a stack-based buffer overflow in the unADF extractor, specifically in the extractTree function, allowing remote code execution via long pathnames. Connected advisories confirm this affects unadf and have led to fixes: Debian LTS advisory DLA-3762-1 notes a patch to unadf (...

CVE-2016-1678

CVE-2016-1678 describes a heap overflow in the V8 JavaScript engine (used by Google Chrome) due to insufficient restriction of lazy deoptimization in objects.cc. Affected software includes V8 up to 5.0.71.32 and Google Chrome up to 51.0.2704.63. Exploitation could allow a remote attacker to cause...

CVE-2016-1687

CVE-2016-1687 affects Google Chrome/Chromium. The vulnerability is an information disclosure in the renderer related to extensions, allowing a remote attacker to obtain sensitive information. The issue is documented as fixed in Chrome 51.0.2704.63 (and corresponding Chromium/debian security updat...

CVE-2016-4085

CVE-2016-4085 : In Wireshark 1.12.x prior to 1.12.11, a stack-based buffer overflow exists in the NCP dissector (epan/dissectors/packet-ncp2222.inc) within the Wireshark NCP dissector. A long string in a network packet can be used by a remote attacker to trigger a denial of service (application c...

CVE-2016-4454

CVE-2016-4454 affects QEMU’s vmsvga_fifo_read_raw path in hw/display/vmware_vga.c. The vulnerability arises when a local privileged guest changes FIFO registers and issues a VGA command, triggering an out-of-bounds read that can disclose host memory or cause a QEMU process crash. Public reference...

CVE-2016-5105

CVE-2016-5105 affects QEMU when MegaRAID SAS 8708EM2 HBA emulation is enabled. The megasas_dcmd_cfg_read path uses an uninitialized variable, enabling a local guest administrator to read host memory via MFI command vectors. Files in connected docs (IBM PowerKVM bulletin and SUSE/OpenSUSE advisori...

CVE-2016-5241

GraphicsMagick vulnerability CVE-2016-5241 affects the GraphicsMagick image processing suite (GraphicsMagick) with vulnerable code path in magick/render.c. The issue occurs when handling SVG input, where a crafted SVG can trigger an arithmetic exception and cause the application to crash, i.e., a...

CVE-2016-8862

CVE-2016-8862 concerns ImageMagick. The vulnerability is in the AcquireMagickMemory function of MagickCore/memory.c, where processing a crafted image (ImageMagick versions before 7.0.3.3) can trigger a memory allocation failure, with unspecified impact. The provided sources describe remote trigge...

CVE-2017-14341

ImageMagick ReadWPGImage in coders/wpg.c (v7.0.6-6) has a large-loop CPU exhaustion vulnerability triggered by a crafted WPG image file, per CVE-2017-14341. The provided connected documents confirm the issue but do not specify a patch or mitigation.

CVE-2017-5097

CVE-2017-5097 affects Google Chrome on Linux, via Skia. Vulnerable component: Skia in Chrome; root cause: insufficient validation of untrusted input leading to an out-of-bounds memory read when processing crafted HTML pages. Impact: potential memory read with partial confidentiality and integrity...

CVE-2017-6299

CVE-2017-6299 affects ytnef/libytnef (libytnef) with a flaw in TNEFFillMapi in lib/ytnef.c prior to 1.9.1 that can cause an infinite loop and potential denial-of-service. The issue is part of multiple libytnef vulnerabilities reported for various Linux distros. Affected component is the libytnef ...

CVE-2017-6303

CVE-2017-6303 is one of multiple libytnef/ytnef vulnerabilities affecting handling of TNEF (winmail.dat) streams. The connected advisories indicate issues such as heap overflows, out-of-bounds reads/writes and NULL pointer dereferences, introduced by insufficient boundary checking in libytnef. Th...

CVE-2017-7654

CVE-2017-7654 affects the Mosquitto MQTT broker (up to version 1.4.15). The issue is a memory-leak in the broker that can be triggered by unauthenticated clients sending crafted CONNECT packets, leading to a denial of service. Affected: Eclipse Mosquitto 1.4.15 and earlier. Impact: DoS of the bro...

CVE-2017-9143

CVE-2017-9143 affects ImageMagick 7.0.5-5: ReadARTImage in coders/art.c can cause a denial of service via a crafted .art file due to a memory leak. The connected documents provide the vulnerability description but do not include exploit details or a confirmed patch/availability.

CVE-2018-10289

MuPDF 1.13.0 is affected by an infinite loop in fz_skip_space (pdf/pdf-xref.c) that can be exploited by a crafted PDF to cause a denial of service. Connected advisories confirm this CVE (CVE-2018-10289) and note mitigations/upgrades. Debian DLA-2765 states the fix is in mupdf 1.14.0+ds1-4+deb9u1;...

CVE-2018-17937

GPSD vulnerabilities (CVE-2018-17937) affect gpsd versions 2.90–3.17 and microjson 1.0–1.3. The issue is a stack-based buffer overflow that can allow remote code execution on embedded platforms via traffic on port 2947/TCP or crafted JSON inputs. Impact is described as remote code execution with ...

CVE-2018-7438

CVE-2018-7438 affects FreeXL up to 1.0.4 (before 1.0.5). The issue is a heap-based buffer over-read in parse_unicode_string, which can lead to denial of service. Public sources (Debian/DSA-4129, Gentoo GLSA-202007-44) document this as a fixable vulnerability; upgrading to freexl 1.0.5 or later is...

CVE-2019-12473

MediaWiki CVE-2019-12473 affects 1.27.0–1.32.1; passing invalid titles to the API could trigger a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

CVE-2019-14496

CVE-2019-14496 affects MilkyTracker (Milkyplay loader: LoaderXM::load in LoaderXM.cpp) where loading XM files can trigger a stack-based buffer overflow. Public descriptions confirm MilkyTracker 1.02.00 is vulnerable. No exploitation details are provided in the supplied documents. Mitigation: appl...

CVE-2019-16235

Dino (XMPP client) is affected by CVE-2019-16235, CVE-2019-16236 and CVE-2019-16237. The underlying issues are improper validation in Dino: CVE-2019-16235 for the source of message carbons, CVE-2019-16236 for roster push authorization, and CVE-2019-16237 for MAM message sources. Exploitation coul...

CVE-2019-5087

CVE-2019-5087 affects xcftools 1.0.7, targeting the flattenIncrementally function in the xcf2png and xcf2pnm binaries. The vulnerability is an exploitable integer overflow while computing a row allocation size, which could corrupt memory and allow arbitrary code execution when a specially crafted...

CVE-2020-10595

CVE-2020-10595 affects the pam-krb5 PAM module. The issue is a buffer overflow in pam_krb5.so when the Kerberos library performs supplemental prompting (e.g., PKINIT or no_prompt PAM options). This can overflow a buffer provided by the underlying Kerberos library, potentially leading to heap/stac...

CVE-2020-26880

CVE-2020-26880—Sympa local privilege escalation : Sympa

CVE-2020-27638

CVE-2020-27638 affects the fastd daemon. The issue is in receive handling in receive.c where packets with an invalid type code trigger an assertion failure, causing a denial of service. Affected software is fastd prior to version 21. The vulnerability’s impact is an availability disruption (parti...

CVE-2020-28611

CVE-2020-28611 affects CGAL libcgal CGAL-5.1.1: memory safety issues in the Nef polygon-parsing code, specifically an out-of-bounds read in SM_io_parser.h SM_io_parser::read_vertex() set_first_out_edge() that can lead to code execution. Connected advisories describe multiple related memory-access...

CVE-2020-28613

CGAL CGAL-5.1.1 is affected by CVE-2020-28613. A crafted Nef polygon input can trigger out-of-bounds reads in SNC_io_parser or related Nef_2/PM_io_parser paths, leading to code execution. Connected advisories confirm this family of OOB-read/code-execution vulnerabilities in CGAL’s Nef parsing (e....

CVE-2020-28622

CGAL-5.1.1 Nef polygon-parsing contains CVE-2020-28622: an out-of-bounds read leading to potential code execution via SNC_io_parser::read_edge() eh->incident_sface() in Nef_S2/SNC_io_parser.h. Debians/GLSA notes confirm multiple related CVEs and advise upgrading CGAL (e.g., to CGAL ≥ 5.4.1 or ...

CVE-2020-3811

CVE-2020-3811 affects netqmail 1.06 (qmail-verify) where improper input handling allows a mail-address verification bypass. Connected Debian/Ubuntu advisories (DLA-2234, USN-4621-1, USN-4556-1) indicate this vulnerability alongside CVE-2020-3812 and older CVEs; mitigation in Debian for Jessie is ...

CVE-2021-36046

The CVE-2021-36046 issue affects Exempi (XMP Toolkit) 2020.1 and earlier, with a memory corruption vulnerability that could lead to arbitrary code execution in the current user context. Exploitation requires user interaction (e.g., opening a crafted file). Public advisories in the connected docum...

CVE-2021-36064

The CVE-2021-36064 issue affects Exempi (XMP Toolkit SDK) up to 2020.1 and earlier with a Buffer Underflow/Underflow vulnerability that could allow arbitrary code execution in the context of the current user when a victim opens a crafted file; user interaction is required. Public advisories acros...