CVE-2018-10876

A confirmed vulnerability in the Linux kernel ext4 filesystem: CVE-2018-10876 is a use-after-free in ext4_ext_remove_space() when mounting a crafted ext4 image, allowing a local attacker to crash the system and, per some sources, potentially execute arbitrary code. Public references in the connec...

CVE-2017-3258

CVE-2017-3258 affects the MySQL Server component (Server: DDL). Affected versions are 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier. An attacker with network access via multiple protocols can exploit this to cause the MySQL Server to hang or crash (partial/complete DoS). CVSSv3.1...

CVE-2017-6831

The CVE-2017-6831 issue affects the Audio File Library (audiofile) 0.3.6 and older, involving a heap-based buffer overflow in IMA.cpp::decodeBlockWAVE that can crash the application via a crafted file (DoS). Advisories (e.g., Arch Linux ASA-201708-9, Debian DSA-3814-1) indicate the fix is upstrea...

CVE-2018-11360

Wireshark GSM A DTAP dissector (Wireshark

CVE-2018-19965

Technical details about CVE-2018-19965 (Xen) are not provided in the connected documents. The initial description lacks vendor/product/version/root-cause/fix specifics. Monitor for updates from Xen advisories.

CVE-2019-19797

CVE-2019-19797 is evidenced in connected records as an out-of-bounds write in read_colordef of Xfig fig2dev 3.2.7b. Multiple advisories (ALAS-2023-1807, SUSE SU-2021:14823-1, Ubuntu USN-5864-1, Debian DLA-2778) map this issue to transfig/fig2dev and cite additional related CVEs. The impact is des...

CVE-2019-20840

CVE-2019-20840 concerns LibVNCServer prior to 0.9.13. The issue in libvncserver/ws_decode.c causes a crash from unaligned accesses in hybiReadAndDecode, with multiple advisories and patches documenting the fix in LibVNCServer-0.9.13+ (and related vendor advisories). The practical impact is crash/...

CVE-2020-21365

CVE-2020-21365 affects wkhtmltopdf up to version 0.12.5, enabling a directory traversal that allows reading local files via crafted HTML processed with default settings. Public advisories from Debian, Mageia, and Ubuntu confirm the vulnerability and note fixes/remediations: Debian DLA-3158 and US...

CVE-2020-27842

CVE-2020-27842 affects the OpenJPEG2 library, specifically the t2 encoder. A crafted input to OpenJPEG prior to version 2.4.0 can trigger a null pointer dereference, with the highest impact being a denial of service through reduced availability. Connected advisories confirm OpenJPEG vulnerabiliti...

CVE-2020-4049

CVE-2020-4049 affects WordPress: when uploading a theme, an attacker who has admin privileges can craft the theme folder name to trigger JavaScript execution in /wp-admin on the themes page. It is described as a low-severity self-XSS requiring admin interaction. A patch is available in WordPress ...

CVE-2020-6427

CVE-2020-6427 is a use-after-free in Google Chrome’s audio subsystem that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Google Chrome (audio path); vulnerability type: use-after-free. Impact: potential remote code execution is described in affected ad...

CVE-2020-6543

CVE-2020-6543 affects Google Chrome/Chromium and is a use-after-free in the task scheduling path that could allow a remote attacker to abuse heap corruption via a crafted HTML page. The vulnerability is described as potentially enabling remote code execution with network attack surface and requir...

CVE-2020-6545

CVE-2020-6545 describes a use-after-free in Chrome’s audio pipeline that could allow remote code execution via a crafted HTML page, due to heap corruption in affected builds up to 84.0.4147.125. Debian and Debian-tracker entries confirm the issue and fix version (84.0.4147.125) was released; mult...

CVE-2020-8518

CVE-2020-8518 is an RCE in Horde Groupware Webmail Edition 5.2.22 via CSV data import, caused by arbitrary PHP code injection in the Horde_Data component. The vulnerability allows authenticated users to execute code on the server hosting the web application. Affected versions include Horde Groupw...

CVE-2021-0308

CVE-2021-0308: In ReadLogicalParts of basicmbr.cc there is a missing bounds check causing an out-of-bounds write. This could enable local escalation of privilege with no additional execution privileges and no user interaction. Affected products listed include Android versions 8.1–11 (Android-8.1,...

CVE-2021-23434

The CVE-2021-23434 entry concerns the Node.js object-path package (versions before 0.11.6) with a type confusion vulnerability that can bypass the CVE-2020-15256 fix when path components are arrays. The condition currentPath === 'proto ' fails for currentPath = ['proto '], enabling potential expl...

CVE-2021-38114

CVE-2021-38114 affects FFmpeg 4.4’s libavcodec/dnxhddec.c, where the init_vlc() function’s return value is not checked, potentially leading to an unspecified impact (Debian and CNVD references describe it as a broader FFmpeg vulnerability with possible denial of service/out-of-bounds effects). Af...

CVE-2022-2285

CVE-2022-2285 : Integer Overflow or Wraparound in vim/vim prior to 9.0. Affected: Vim (vim/vim) before 9.0. The connected advisories confirm the CVE is cataloged alongside other vim vulnerabilities, but the provided documents do not detail the exact root-cause beyond the overflow/wraparound label...

CVE-2022-23517

CVE-2022-23517 affects rails-html-sanitizer: older configurations (versions

CVE-2024-35809

The CVE-2024-35809 entry describes a race in the Linux kernel's PCI runtime power management path: the .runtime_idle() callback in rtsx_pcr PCI driver can still be running when pm_runtime_get_sync() returns, leading to a race with the post-sync code and a potential kernel crash due to an unhandle...

CVE-2024-35866

CVE-2024-35866: Linux kernel SMB CIFS client use-after-free in cifs_dump_full_key() addressed by skipping sessions tearing down (status == SES_EXITING) to prevent UAF. Connected docs confirm this fix and list multiple downstream advisories (e.g., ALAS2KERNEL, ALAS2023, Debian DLA-4193-1) referenc...

CVE-2024-49883

In CVE-2024-49883, the Linux kernel ext4 ext4_ext_insert_extent() is vulnerable to use-after-free when a path is reallocated in ext4_ext_create_new_leaf(), leaving a stale path in ext4_ext_insert_extent() and triggering UAF (KASAN) during map/write paths. The issue is reproduced via a realloc of ...

CVE-2009-3094

The CVE-2009-3094 issue affects Apache HTTP Server’s mod_proxy_ftp (ap_proxy_ftp_handler in proxy modules) and is caused by insufficient input validation in responses to EPSV commands. This allowed remote FTP servers to trigger a NULL pointer dereference, crashing a child httpd process and causin...

CVE-2015-5219

CVE-2015-5219 affects the Network Time Protocol (NTP) SNTP components, specifically the sntp utility, prior to version 4.2.7p366. The root cause is an incorrect type conversion in the ULOGTOD function (precision → double) which can cause a crafted NTP packet to trigger an infinite loop in sntp, l...

CVE-2015-7704

CVE-2015-7704 describes a denial-of-service in ntpd caused by handling of Kiss-of-Death (KoD) messages. The issue arises from KoD processing that could delay or stop querying time sources. Affected software: ntpd in NTP 4.x prior to 4.2.8p4 and 4.3.x prior to 4.3.77. Impact: unauthenticated remot...

CVE-2015-8080

CVE-2015-8080 is an in Redis where the getnum function in lua_struct.c can overflow an integer if a Lua script processes a large number. Affects Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6. The described impact is memory corruption and application crash, with potential sandbox circumvention....

CVE-2017-10379

CVE-2017-10379 concerns the MySQL Server client-side component of Oracle MySQL. Affected versions are 5.5.57 and earlier, 5.6.37 and earlier, and 5.7.19 and earlier. The vulnerability can be exploited by a low-privileged attacker with network access via multiple protocols, potentially leading to ...

CVE-2017-5380

CVE-2017-5380 is a use-after-free vulnerability related to SVG content processing. Connected IBM advisories confirm this CVE ID is present and tie it to vulnerabilities in Mozilla Firefox shipped with IBM Storwize V7000 Unified and IBM SONAS. Affected IBM products and versions are IBM Storwize V7...

CVE-2018-12360

CVE-2018-12360 is a use-after-free vulnerability in Thunderbird (and Firefox components) triggered by deleting an input element during a mutation event handler invoked by focusing that element. Affected versions include Thunderbird before 60 and Thunderbird before 52.9.1; Firefox ESR before 60.1/...

CVE-2018-8787

CVE-2018-8787 affects FreeRDP prior to 2.0.0-rc4. It describes an Integer Overflow in gdi_Bitmap_Decompress() that leads to a heap-based memory corruption with potential remote code execution. Remediation is to upgrade to FreeRDP 2.0.0-rc4 or newer (as referenced by linked advisories). The vulner...

CVE-2019-25033

CVE-2019-25033 : Unbound before 1.9.5 has an integer overflow in the regional allocator via the ALIGN_UP macro. The vendor disputes this as a vulnerability; a running Unbound installation cannot be remotely or locally exploited. Public docs reference this CVE across multiple advisories linked to ...

CVE-2020-16011

CVE-2020-16011 is a heap buffer overflow in Google Chrome’s Windows UI, prior to version 86.0.4240.183, that could allow a remote attacker who has compromised the renderer to potentially escape the Chrome sandbox via a crafted HTML page. Public advisories (Debian, FreeBSD, Debian DSA, and Chrome ...

CVE-2020-16117

CVE-2020-16117 affects GNOME evolution-data-server, prior to 3.35.91. A malicious server can crash the mail client by sending an invalid CAPABILITY line during a connection, causing a NULL pointer dereference in the imapx_free_capability/imapx_connect_to_server path. The issue is a client-side cr...

CVE-2020-1766

CVE-2020-1766 affects OTRS/Open Source Ticket Request System where improper handling of uploaded images can, in very rare conditions, cause a browser to execute malicious JavaScript from a crafted SVG rendered as an inline JPG. Public advisories in connected documents refer to multiple vendor upd...

CVE-2020-6560

CVE-2020-6560 concerns Google Chrome’s autofill: insufficient policy enforcement before version 85.0.4183.83 can allow a remote attacker to leak cross-origin data via a crafted HTML page. The affected component is autofill policy enforcement in Chrome; root cause is improper policy checks that ex...

CVE-2020-9431

Wireshark LTE RRC dissector memory leak CVE-2020-9431 affects Wireshark versions 3.2.0–3.2.1, 3.0.0–3.0.8, and 2.6.0–2.6.14. Root cause: memory leak from certain append operations in epan/dissectors/packet-lte-rrc.c. Remediation: code fix adjusted the append operations to prevent leaks. Connected...

CVE-2021-21160

CVE-2021-21160 is a heap buffer overflow in WebAudio within Chromium/Google Chrome prior to version 89.0.4389.72. A remote attacker could exploit this via a crafted HTML page to cause heap corruption. The connected sources confirm this issue across multiple advisories (Chromium/Chromebook updates...

CVE-2023-28856

CVE-2023-28856 affects Redis where an authenticated user can use the HINCRBYFLOAT command to create an invalid hash field that will crash the Redis server on access. The issue is fixed in Redis releases 7.0.11, 6.2.12, and 6.0.19. Affected product: Redis server (in-memory DB with on-disk persiste...

CVE-2023-52622

CVE-2023-52622 concerns an ext4 online resizing failure when flexbg_size is oversized. Affected Linux kernel workflows (mkfs.ext4 -G, mount, resize2fs) could trigger WARN_ON at __alloc_pages/__kmalloc during ext4_resize_fs, caused by MAX_RESIZE_BG exceeding available memory groups. The minimum MA...

CVE-2024-35896

CVE-2024-35896 concerns the Linux kernel’s netfilter/SockOpt path. The description shows a fix for validating user input length in nf_setsockopt, preventing a slab-out-of-bounds read traced to copy_from_sockptr_offset used during iptables/setsockopt handling. The issue manifested as a read of siz...

CVE-2024-35930

CVE-2024-35930 concerns the Linux kernel SCSI lpfc driver. It fixes a memory leak in lpfc_rcv_padisc() where a failed return from lpfc_sli4_resume_rpi() could leave an elsiocb unreleased and its resources leaked. The remediation is to check the return value of lpfc_sli4_resume_rpi() and, on failu...

CVE-2024-35947

Technical details about CVE-2024-35947 are not publicly provided in the supplied documents; the initial entry notes the Linux kernel BUG_ON fix but no affected products/versions or remediation specifics beyond references. Monitor for updates.

CVE-2024-36940

CVE-2024-36940 – Linux kernel pinctrl double-free issue Root cause: In the pinctrl core, freeing the pctldev is managed via devm_pinctrl_dev_release(), but the code in pinctrl_enable() frees that struct again, causing a double-free. The devm lifecycle is intended to release automatically; manual ...

CVE-2010-3705

The vulnerability CVE-2010-3705 affects the Linux kernel SCTP code: sctp_auth_asoc_get_hmac in net/sctp/auth.c does not validate the hmac_ids array from a remote peer, enabling remote attackers to trigger memory corruption and a kernel panic. Affected versions are Linux kernel before 2.6.36; reme...

CVE-2015-4870

CVE-2015-4870 is an unspecified MySQL Server vulnerability affecting the Parser, enabling remote authenticated DoS. Connected docs show exploitation via the MySQL 5.5.45/older and 5.6.26/older series through the Procedure ANALYSE function (DoS). An exploit demonstrates that MySQL 5.5.45 is vulner...

CVE-2015-5211

CVE-2015-5211 affects Pivotal/Spring Framework where a crafted URL with a batch script extension can trigger a reflected file download, potentially downloading a malicious response. The linked IBM bulletin details exploit scenarios (RFD/open redirect risks) and provides a remediation path urging ...

CVE-2016-9899

CVE-2016-9899 describes a use-after-free in Firefox/Thunderbird caused by errors in node adoption handling during DOM event manipulation and audio element removal. Affected: Firefox < 50.1, Firefox ESR < 45.6, Thunderbird

CVE-2017-10664

CVE-2017-10664 affects qemu-nbd in QEMU. The issue arises because SIGPIPE is not ignored, allowing remote attackers to trigger a denial of service (daemon crash) by disconnecting during a server-to-client reply. The vulnerability is referenced across multiple advisories and Nessus plugins (e.g., ...

CVE-2017-12153

CVE-2017-12153 refers to a security flaw in the Linux kernel where nl80211_set_rekey_data() in net/wireless/nl80211.c does not validate required Netlink attributes, enabling a local attacker with CAP_NET_ADMIN to trigger a NULL pointer dereference and system crash. The vulnerability is described ...

CVE-2017-3135

ISC BIND 9 DNS64 and RPZ combined can crash the server. CVE-2017-3135 causes an assertion failure or NULL pointer dereference when query responses are rewritten with both DNS64 and RPZ enabled, leading to a denial of service. Affected versions include BIND 9.8.8 and 9.9.3–9.9.9 (S1–S7/P5), 9.9.10...