CVE-2011-1136

CVE-2011-1136 affects tesseract versions 2.03 and 2.04. The issue enables a local attacker to rewrite an arbitrary user file by guessing a process ID and creating a link to the user’s file, indicating a local-privilege-like impact with integrity risk. The connected documents corroborate the descr...

CVE-2013-2106

Technical details (affected product, component, version, root cause or fix) are not publicly available in the provided documents; monitor for updates.

CVE-2014-10073

Psensor is affected by a directory traversal in the create_response function of server/server.c prior to version 1.1.4, allowing access to files under the webserver directory. This stems from a missing check that verifies a requested path is under the webserver root. The vulnerability impacts Pse...

CVE-2018-7874

The CVE-2018-7874 entry concerns an invalid memory address dereference in strlenext (util/decompile.c) of libming 0.4.8, causing a segmentation fault and a denial of service. The provided documents confirm the vulnerable component and the crash-inducing root cause but do not include details on af...

CVE-2025-39714

CVE-2025-39714 affects the Linux kernel media/usbtv subsystem. When streaming (e.g., ffplay) and another process changes TV standard NTSC↔PAL, the kernel could crash by copying to unmapped memory, caused by an overflow in the usbtv video plane buffer due to the struct’s increased resolution not b...

CVE-2025-39788

CVE-2025-39788 affects the Linux kernel SCSI/ufs Exynos driver (gs101). The issue is in the USB/UFS host path where the left shift to set UTRL_NEXUS_TYPE is performed on an int, causing an out-of-bounds shift and writing an incorrect value (0xffffffff on gs101). The fix switches to the BIT() macr...

CVE-2025-39825

CVE-2025-39825 affects the Linux kernel SMB client. The vulnerability is a race with concurrent opens during rename(2): in addition to sending the rename to the server, the operation also closes deferred closes, waits for outstanding I/O, and marks existing open handles as deleted, which enlarges...

CVE-2025-39826

CVE-2025-39826 : In the Linux kernel, the net/rose_neigh struct’s use field was a non-atomic reference counter, risking use-after-free if the rose_neigh is freed while still referenced. The fix converts the field from unsigned short to refcount_t and switches code paths to rose_neigh_hold() and r...

CVE-2025-39853

CVE-2025-39853 affects the Linux kernel i40e driver. The issue arises when the MAC list is empty, as list_first_entry() can return a pointer to an invalid object, risking invalid memory access upon use. The advisory notes the fix is to replace list_first_entry() with list_first_entry_or_null(), p...

CVE-2025-39914

CVE-2025-39914 affects the Linux kernel tracing subsystem. The issue occurs when a fault injection triggers a failure during chunk allocation in trace_pid_list_alloc, causing trace_pid_list_set to fail and potentially trigger a double registration of the same tracepoint (tracepoint_add_func). The...

CVE-1999-0939

Technical details about CVE-1999-0939 are not provided in the supplied documents; monitor for updates.

CVE-1999-1048

CVE-1999-1048 affects Bash versions including 2.0.0 and 1.4.17, where a buffer overflow can be triggered by an extremely large directory name. The vulnerability is exploited via the PS1 prompt (\w) when another user changes into that directory, enabling local privilege escalation. The provided do...

CVE-2000-0584

CVE-2000-0584 affects the Canna input service. The vulnerability is a buffer overflow in the SR_INIT handling that can occur when a long user name or group name is supplied, enabling a remote attacker to crash the service and may allow arbitrary code execution. The issue is documented across mult...

CVE-2001-0457

CVE-2001-0457 affects man2html prior to 1.5-22. The Debian security advisory DSA-035-1 and OpenVAS entries warn that remote attackers could trigger a denial of service via memory exhaustion. A patch/update to the affected man2html package is the indicated remediation. The OpenVAS NASL notes the i...

CVE-2010-3359

CVE-2010-3359 affects gargoyle-free prior to 2009-08-25: if LD_LIBRARY_PATH is undefined, it may point to the current directory, allowing a local user to trick another user into executing gargoyle in a directory containing a cracked libgarglk.so and gain access to the user's account. The connecte...

CVE-2012-2248

CVE-2012-2248 affects dhclient 4.3.1-6 due to an embedded path variable, described across multiple sources as a path traversal issue. The available connected documents consistently identify the problem as a vulnerability in the dhclient component, but do not provide concrete exploitation steps, a...

CVE-2025-38622

CVE-2025-38622 — Linux kernel UDP/GSO issue : The vulnerability occurs in the UDP receive path when a packet with virtio_net_hdr using SKB_GSO_UDP and a gso_size smaller than the UDP header can trigger a crash in skb_pull_rcsum, leading to a kernel BUG in net/core/skbuff.c and a local attacker ma...

CVE-2025-38680

The CVE CVE-2025-38680 affects the Linux kernel media: uvcvideo component, where a 1-byte out-of-bounds read can occur in uvc_parse_format(). The root cause is a buffer length check that only guaranteed buf > 2, while the code accesses buffer[3], requiring at least 4 bytes. The vulnerability’s...

CVE-2025-38697

The CVE relates to the Linux kernel JFS: an upper bound check in dbAllocAG when computing the tree index could go out of bounds if filesystem metadata is corrupted. This could enable a local attacker to trigger out-of-bounds conditions in JFS data structures. The vulnerability is resolved in the ...

CVE-2025-39724

CVE-2025-39724 affects the Linux kernel serial 8250 driver. When PSLVERR_RESP_EN=1, an error response can be generated reading an empty RBR with FIFO enabled due to a race in serial8250_do_startup/DW paths. The fix wraps serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under port->lock to preve...

CVE-2010-4533

CVE-2010-4533 affects offlineimap prior to version 6.3.4, where SSL certificate validation was added but SSLv2 is still enabled. This keeps SSLv2’s known weaknesses and yields high CVSS metrics (Confidentiality/Integrity/Availability partial in CVSS2; Critical in CVSS3.1). The connected documents...

CVE-2012-0051

Technical details about CVE-2012-0051 are not publicly provided in the supplied connected documents. Monitor for updates from vendors and security advisories.

CVE-2025-38695

CVE-2025-38695 affects the Linux kernel SCSI lpfc, where lpfc_sli4_vport cleanup can run before sli4_hba.hdwqs are allocated if lpfc_sli4_read_rev() fails. This may cause a NULL pointer dereference when acquiring abts_io_buf_list_lock for the first hardware queue. The fix adds a NULL pointer chec...

CVE-2025-38713

CVE-2025-38713 concerns a slab-out-of-bounds read in the Linux kernel’s hfsplus handling. The issue occurs in hfsplus_uni2asc(), which can be triggered via hfsplus_readdir() and may crash the kernel (KASAN slab-out-of-bounds). The connected documents confirm a fix in the kernel source to address ...

CVE-2025-38714

CVE-2025-38714 affects the Linux kernel’s HFS+ subsystem. The issue is a slab-out-of-bounds in hfsplus_bnode_read(), leading to potential memory corruption during operations that touch HFS+ bnodes. The connected advisories indicate a fix has been applied in upstream kernel code (hfsplus_bnode_rea...

CVE-2025-39681

CVE-2025-39681 relates to the Linux kernel on x86 with Hygon CPUs. The root cause was a missing resctrl_cpu_detect() call in the Hygon BSP init path after resctrl_cpu_detect() was moved to vendor-specific init code. This caused a division-by-zero in get_rdt_mon_resources() during early boot due t...

CVE-2025-39715

CVE-2025-39715 affects the Linux kernel on Parisc where a read-access check was not triggered for certain user-access memory references, allowing a local attacker to execute a LWS compare-and-swap at an address that is read-protected at PRIV_USER. The issue is fixed by probing read access rights ...

CVE-2025-39756

CVE-2025-39756 is a Linux kernel issue where extremely high nr_open values (e.g., 1073741816) can trigger massive file descriptor table allocations that exceed INT_MAX, causing a kernel warning and impractical memory requests (>8GB) during operations near the FD limit. The root cause involves ...

CVE-2011-4931

Technical details about CVE-2011-4931 are not publicly provided in the connected documents. No vendor, product, version, impact, or fix specifics are disclosed here. Monitor for updates.

CVE-2025-38701

CVE-2025-38701 relates to ext4 in the Linux kernel where a syzbot-triggered BUG_ON could occur when INLINE_DATA_FL is set but the system.data xattr is missing. The fix replaces BUG_ON with EXT4_ERROR_INODE() in ext4_create_inline_data() and ext4_inline_data_truncate(), and documents reporting a c...

CVE-2025-39673

CVE-2025-39673 affects the Linux kernel PPP code, specifically the function ppp_fill_forward_path, which had two race conditions. First, the ppp->channels list could be reconfigured between list_empty() and list_first_entry() because ppp_lock() was not held, risking access to an empty head or ...

CVE-2025-39685

Summary (CVE-2025-39685) : In the Linux kernel, the comedi pcl726 driver could trigger an out-of-bounds when an excessively large IRQ number was passed (example 0x80008000). The fix adds an interrupt number check to prevent passing an IRQ number that is too large. It notes that if it->options[...

CVE-2025-39772

CVE-2025-39772 affects the Linux kernel HibMC driver for Hisilicon GPUs (drm/hisilicon/hibmc). Description: when hibmc loading fails, the driver attempted to free resources via hibmc_unload, but mode.config mutexes were uninitialized, risking a NULL-pointer dereference. The fix replaces a goto cl...

CVE-2001-0069

CVE-2001-0069 affects the Debian GNU/Linux package dialog prior to version 0.9a-20000118-3bis. The vulnerability is a symlink attack that allows a local user to overwrite arbitrary files. The issue arises from a race condition involving symlinks, enabling manipulation of file targets by a non-pri...

CVE-2001-0755

CVE-2001-0755 concerns a buffer overflow in the ftp daemon (ftpd) 6.2 used in Debian GNU/Linux. The vulnerability allows a remote attacker to trigger a denial of service and potentially execute arbitrary code by sending a long SITE command. The available connected sources confirm the affected com...

CVE-2013-1425

CVE-2013-1425 affects ldap-git-backup; vulnerable versions are prior to 1.0.4. The root cause is incorrect directory permissions that allow exposure of password hashes. Impact stated is partial confidentiality loss (password hashes exposed). No exploitation details or active exploit status are pr...

CVE-2013-1809

CVE-2013-1809 affects Gambas before 3.4.0. The issue arises from insecure temporary directories, allowing remote attackers to move or manipulate directory contents or perform symlink attacks. This is documented across multiple sources (NVD entry and related advisories). The provided materials des...

CVE-2017-17527

PasDoc 0.14 is affected by a vulnerability in delphi_gui/WWWBrowserRunnerDM.pas where strings are not validated before launching the program specified by the BROWSER environment variable. This may allow an attacker to perform argument-injection via a crafted URL. Several sources (NVD, CNVD, OSV, ...

CVE-2025-10922

CVE-2025-10922 affects GIMP, specifically the DCM file parsing component. It is a heap-based buffer overflow vulnerability that can lead to remote code execution and requires user interaction (visiting a malicious page or opening a malicious file). The issue arises from insufficient validation of...

CVE-2025-38698

Summary: CVE-2025-38698 affects the Linux kernel JFS file system. A vulnerability allows regular file operations to fail or corrupt due to a corrupted on-disk file created with a negative i_size. The fix adds a check when opening such files to prevent subsequent operation failures, addressing pot...

CVE-2025-38711

CVE-2025-38711 : Linux kernel vulnerability fixed in smb/server deadlock scenario when linking with ReplaceIfExists. If smb2_create_link() is called with ReplaceIfExists and the target name exists, ksmbd_vfs_kern_path_locked() locks the parent, then ksmbd_vfs_remove_file() deletes the file, and k...

CVE-2025-38712

CVE-2025-38712 refers to a Linux kernel issue in the hfsplus code path. Root cause: when the volume header has values not reflecting the filesystem state, hfsplus_fill_super() may assume the attributes file isn’t created and call hfsplus_create_attributes_file(), hitting a BUG_ON(). The fix repla...

CVE-2025-38715

Technical details for CVE-2025-38715 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2017-6498

CVE-2017-6498: Rejected reason: this CVE is withdrawn and not a security issue.

CVE-2025-38645

CVE-2025-38645 affects the Linux kernel (net/mlx5). Root cause: a NULL device memory pointer (dev->dm) can be dereferenced in mlx5_init_once() if allocation fails. Fix: add a NULL check before accessing device memory to prevent a crash. Impact in docs: LOCAL attacker could crash the system; re...

CVE-2025-38683

CVE-2025-38683 affects hv_netvsc in the Linux kernel. The issue arises during namespace deletion when a VF NIC is moved to a new namespace and then back, causing netdev list handling to dereference NULL and trigger a kernel panic. The supplied references describe the root cause as a race in defau...

CVE-2025-38687

The CVE-2025-38687 issue affects the Linux kernel’s comedi subsystem, where a race between polling and detaching a device can lead to a use-after-free of the wait_queue_head memory. The root cause is the removal of the allocated async area while poll requests are still active on subdevice wait qu...

CVE-2025-63261

AWStats 8.0 is vulnerable to Command Injection due to a flaw in the open function . This vulnerability allows an attacker to execute arbitrary commands on the host system. For example, on Debian 11 bullseye , the issue is addressed in version 7.8-2+deb11u2 . While the core cause is identified as ...

CVE-2006-1376

CVE-2006-1376 affects Debian GNU/Linux 3.1r1 network install: /var/log/debian-installer/cdebconf is created with world-writable permissions, enabling local users to trigger a denial of service via disk consumption. The connected documents confirm this behavior across multiple feeds (NVD, OSV, UB,...

CVE-2006-1772

CVE-2006-1772 affects Debian GNU/Linux where, during configuration of mnogosearch in the mnogosearch-common 3.2.31-1 package, the debconf process stores the cleartext database administrator password in a world-readable config.dat instead of the restricted passwords.dat in mnogosearch-common/datab...