CVE-2024-35967

CVE-2024-35967: Linux Bluetooth SCO path vulnerable to not validating setsockopt input. syzbot reports copying data without input length check, causing slab-out-of-bounds reads via copy_from_sockptr_offset in include/linux/sockptr.h and an observed slab-out-of-bounds in sco_sock_setsockopt+0xc0b/...

CVE-2025-38001

The CVE-2025-38001 issue affects the Linux kernel HFSC scheduling path (net_sched) and is triggered by a flawed enqueue path. The root cause is a reentrancy problem in hfsc_enqueue where a class can be inserted twice into the eltree when HFSC_RSC is used, because the code only checks cl->cl_na...

CVE-2011-4516

CVE-2011-4516 affects JasPer, specifically the heap-based buffer overflow in the function jpc_cox_getcompparms (libjasper/jpc/jpc_cs.c) within JasPer 1.900.1. A crafted value in a COD (coding style default) marker segment of a JPEG2000 file can cause remote code execution or memory corruption, po...

CVE-2015-1855

CVE-2015-1855 affects Ruby’s OpenSSL hostname matching: the OpenSSL extension fails to validate hostnames, allowing server spoofing. Affected: Ruby/OpenSSL before 2.0.0 patchlevel 645; 2.1.x before 2.1.6; 2.2.x before 2.2.2. Root cause: permissive hostname matching (wildcards, IDNA, case, non‑ASC...

CVE-2016-3616

The CVE-2016-3616 issue affects the cjpeg utility in libjpeg/libjpeg-turbo, caused by a NULL pointer dereference in libjpeg that can lead to denial of service and potentially arbitrary code execution via a crafted JPEG. Multiple connected advisories confirm affected contexts (Debian, Red Hat, Cen...

CVE-2017-2616

CVE-2017-2616 describes a race condition in util-linux before 2.32.1 where the su command’s handling of child processes could allow a local authenticated attacker to kill other processes with root privileges under certain conditions. Public advisories (Red Hat RHSA-2017:0907, CentOS/CESA entries,...

CVE-2018-11781

CVE-2018-11781 is an Apache SpamAssassin vulnerability describing a local user code injection in the meta rule syntax. Affected software is SpamAssassin 3.4.2 (upstream) with fixes implemented to address the issue. Deb/kern sources indicate this is a local-execution flaw rather than remote, tied ...

CVE-2018-14350

CVE-2018-14350 : In Mutt before 1.10.1 and NeoMutt before 2018-07-16, imap/message.c contains a stack-based buffer overflow when handling a FETCH response with a long INTERNALDATE. This can allow arbitrary code execution. Affected versions: Mutt < 1.10.1; NeoMutt

CVE-2018-5097

CVE-2018-5097 is a use-after-free vulnerability in XSL transformations where the source document is manipulated by script content during transformation. Affected products include Mozilla Thunderbird and Firefox variants prior to version 52.6/58, with upstream fixes targeting Thunderbird 52.6.0 (a...

CVE-2018-5148

CVE-2018-5148 is a use-after-free in Firefox/Firefox ESR’s compositor triggered during certain graphics operations due to using a raw pointer instead of a reference-counted one. Affected versions include Firefox ESR < 52.7.3 and Firefox

CVE-2018-5155

CVE-2018-5155 is a use-after-free in the layout code when processing SVG text-paths during animations, causing a potentially exploitable crash. Affected products include Thunderbird and Firefox: Thunderbird < 52.8 (including ESR), and Firefox

CVE-2019-13147

CVE-2019-13147 affects Audio File Library (audiofile) 0.3.6, via a NULL pointer dereference in ulaw2linear_buf (G711.cpp in libmodules.a) that could cause a denial of service with a crafted file. Connected advisories confirm fixes across distros: Debian 0.3.6-5+deb11u1; openSUSE/SUSE updates (e.g...

CVE-2019-25031

CVE-2019-25031 : Unbound prior to 1.9.5 is said to allow configuration injection via create_unbound_ad_servers.sh if an attacker can perform a MITM on a cleartext HTTP session. The connected documents reiterate that the vendor does not consider this a Unbound vulnerability and note that the scrip...

CVE-2019-9704

CVE-2019-9704 affects Vixie Cron in Debian, where the daemon can crash via a large crontab file due to calloc return value not being checked. Affects Debian package 3.0pl1-133 and earlier; remediation is to upgrade to 3.0pl1-133 or later. The connected Broadcom advisory also references CVE-2019-9...

CVE-2019-9705

CVE-2019-9705 affects Vixie Cron prior to Debian 3.0pl1-133, allowing local users to cause memory DoS by submitting an unlimited number of crontab lines. Connected sources confirm the issue is a local denial of service due to memory consumption from large crontabs. The Broadcom advisory re-states...

CVE-2020-12823

OpenConnect 8.09 contains a buffer overflow in get_cert_name (gnutls.c) triggered by crafted certificate data, leading to denial of service (crash) and potential further impact. Multiple connected advisories confirm the issue and note that OpenConnect 8.10 fixes it (upgrading is recommended). The...

CVE-2020-14402

CVE-2020-14402 affects the LibVNCServer project, specifically the libvncserver/corre.c code path, where an out-of-bounds access is possible via encodings. The public description, and multiple connected advisories/plugins, consistently reference this issue as present in LibVNCServer before version...

CVE-2020-14405

CVE-2020-14405 is reported in LibVNCServer prior to 0.9.13 for libvncclient/rfbproto.c not limiting TextChat size. The connected Nessus advisories confirm the presence of this vulnerability across several distributions and list the CVE as affecting libvncserver, but do not provide exploit details...

CVE-2020-28241

CVE-2020-28241 affects libmaxminddb prior to 1.4.3. A heap-based buffer over-read in dump_entry_data_list (maxminddb.c) is the root cause. Public advisories confirm the library as the vulnerable component; multiple sources (ALMA, Fedora, Debian) indicate fixes in libmaxminddb 1.4.3 and related se...

CVE-2020-35965

CVE-2020-35965 affects FFmpeg 4.3.1’s libavcodec/exr.c, where decode_frame can write out of bounds due to faulty calculations of when to perform memset zero operations. This is a memory corruption risk described across multiple advisories tied to FFmpeg vulnerabilities. From the connected documen...

CVE-2020-4031

CVE-2020-4031 affects FreeRDP prior to 2.1.2, with a use-after-free in the gdi_SelectObject path. All FreeRDP clients operating in compatibility mode using /relax-order-checks are exposed. The issue is mitigated by upgrading to FreeRDP 2.1.2 or later, which contains the fix. The available documen...

CVE-2020-6428

CVE-2020-6428 involves a use-after-free in the audio component of Google Chrome prior to 80.0.3987.149, potentially enabling a remote attacker to trigger heap corruption via a crafted HTML page. Affected software includes Google Chrome and Chromium-based builds; Debian, Fedora, Gentoo, and Alpine...

CVE-2020-6546

CVE-2020-6546 affects Google Chrome on Windows/macOS/Linux via an Inappropriate implementation in the installer. The root cause is an flawed installer flow that can be abused by a local attacker to escalate privileges through a crafted filesystem, as detailed in multiple advisories. The impact is...

CVE-2020-6573

CVE-2020-6573 affects Chromium before 85.0.4183.102. A use-after-free in the video component could allow a remote attacker, with renderer access, to escape the sandbox via a crafted HTML page, potentially leading to arbitrary code execution. Remediation: upgrade to 85.0.4183.102 or newer as indic...

CVE-2021-21176

CVE-2021-21176 is an issue in Chromium/Google Chrome’s full screen mode where an inadequate implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Affected products include Chrome/Chromium prior to version 89.0.4389.72 across multiple advisories; the root...

CVE-2021-21178

CVE-2021-21178 refers to an inappropriate implementation in the Chromium/Google Chrome compositor on Linux and Windows, allowing a remote attacker to spoof the Omnibox via a crafted HTML page. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact: content spoofing of the URL bar. Root c...

CVE-2021-39242

HAProxy contains a vulnerability (CVE-2021-39242) affecting 2.2 prior to 2.2.16, 2.3 prior to 2.3.13, and 2.4 prior to 2.4.3 where mismatch between Host and authority can allow an attacker-controlled HTTP Host header. Reports indicate this could enable manipulation of requests and potential impac...

CVE-2021-4206

CVE-2021-4206 affects the QEMU QXL display device emulation. An integer overflow in cursor_alloc() can cause a small cursor object to be allocated and then trigger a heap-based buffer overflow, enabling a privileged guest user to crash the QEMU process on the host or potentiallyExecute arbitrary ...

CVE-2022-23038

CVE-2022-23038 affects Linux PV device frontends that use the grant-table interfaces (blkfront, netfront, scsifront) and the gntalloc/xenbus components. The issue is a race in removing or delaying the revocation of granted access to memory pages, which can allow a malicious backend to keep access...

CVE-2022-27386

CVE-2022-27386 is a MariaDB Server vulnerability affecting v10.7 and below, caused by a segmentation fault in sql_class.cc that can crash the server. Public advisories (Astra Linux, AlmaLinux, Debian DLA, Amazon Linux) confirm the issue and list affected packages and suggested updates. Remediatio...

CVE-2016-0797

CVE-2016-0797 concerns OpenSSL’s BN_hex2bn/BN_dec2bn handling of long digit strings. The issue enables remote denial of service via heap memory corruption or NULL pointer dereference in OpenSSL 1.0.1 (before 1.0.1s) and 1.0.2 (before 1.0.2g). Root cause is improper length calculation of big numbe...

CVE-2016-9900

CVE-2016-9900 describes that data: URLs used by SVG images can bypass security restrictions, enabling cross-domain data leakage. Affected products include Mozilla Firefox (non-ESR) prior to 50.1, Firefox ESR prior to 45.6, and Thunderbird prior to 45.6. Root cause is the handling of external reso...

CVE-2017-18078

The CVE-2017-18078 issue affects systemd-tmpfiles in systemd prior to 237. The root cause is that tmpfiles may attempt ownership/permission changes on hardlinked files even when fs.protected_hardlinks is off, enabling a local attacker to bypass access restrictions by using a hard link to a file t...

CVE-2017-9079

Dropbear before 2017.75 may allow local users to read files as root when ~/.ssh/authorized_keys contains a command= option. The root privilege is involved because authorized_keys is read with root privileges and symlinks are followed. The underlying issue is that Dropbear parsed authorized_keys a...

CVE-2018-12396

CVE-2018-12396 is a Mozilla Firefox/Firefox ESR vulnerability where a WebExtension can run content scripts in disallowed contexts after certain navigation/events, enabling potential privilege escalation on sites where such scripts shouldn’t run. Multiple connected advisories confirm the issue and...

CVE-2018-16644

ImageMagick 7.0.8-11 contains CVE-2018-16644: a missing length check in ReadDCMImage (coders/dcm.c) and ReadPICTImage (coders/pict.c) enables a remote attacker to cause a denial of service via a crafted image. Technical details beyond this (e.g., exact vectors or patched versions) are not provide...

CVE-2018-5102

CVE-2018-5102 is a use-after-free in HTML media element handling with media streams, affecting Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox

CVE-2019-17672

CVE-2019-17672 affects WordPress prior to 5.2.4, where a stored XSS vulnerability allows injection of JavaScript into STYLE elements. The issue is tied to WordPress versions before 5.2.4 and is mitigated by upgrading to WordPress 5.2.4 or later (WordPress security release). The provided documents...

CVE-2019-20788

CVE-2019-20788 affects LibVNCServer (LibVNCClient) in libvncclient/cursor.c up to version 0.9.12, where HandleCursorShape can overflow an integer value and trigger a heap-based buffer overflow when a cursor shape with a large height or width is supplied. This corresponds to an impact on code hand...

CVE-2020-11049

CVE-2020-11049 : In FreeRDP, there is an out-of-bounds read of client memory that is then passed on to the protocol parser. This vulnerability affects FreeRDP releases prior to the patch and has been explicitly fixed in version 2.0.0. The available documents describe the issue as an OOB read in t...

CVE-2020-12863

The CVE-2020-12863 issue is an out-of-bounds read in SANE Backends prior to 1.0.30, enabling a local-network attacker connected to the same host to read sensitive data (e.g., ASLR offsets). Multiple connected advisories confirm the same root cause and note fixes in subsequent sane-backends releas...

CVE-2020-15965

CVE-2020-15965: Type confusion in V8 within Google Chrome prior to 85.0.4183.121 allows remote attackers to trigger out-of-bounds memory access via crafted HTML, potentially leading to arbitrary code execution or memory corruption. Affected component is Chrome’s V8 engine; impact described as rem...

CVE-2020-15979

CVE-2020-15979 affects Chromium/Google Chrome’s V8 engine prior to 86.0.4240.75. The Arch Linux ASA-202010-1 describes it as an appropriate implementation security issue in V8, labeled as an access restriction bypass. The Debian/DSA and Debian tracker entries also reference the CVE in the Chromi...

CVE-2020-15981

CVE-2020-15981 is an information-disclosure/out-of-bounds-read issue in the audio component of Chromium/Google Chrome prior to 86.0.4240.75. The vulnerability affects Chromium-based browsers and could allow a remote attacker to read potentially sensitive memory content via a crafted HTML page. Pu...

CVE-2020-16005

CVE-2020-16005 concerns the ANGLE component of Chromium (Chromium/Chrome) prior to the patch level 86.0.4240.183. The documented root cause is insufficient policy enforcement in ANGLE, which could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to a...

CVE-2020-16006

Chromium vulnerability CVE-2020-16006 concerns an inappropriate implementation in V8 prior to version 86.0.4240.183, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected software is the Chromium browser (V8 engine component). Impact is remote code ex...

CVE-2020-6424

CVE-2020-6424 is a use-after-free in Chrome’s media handling that could allow heap corruption via a crafted HTML page on Chrome versions prior to 80.0.3987.149. Affected: Google Chrome (desktop). Root cause: use-after-free in media code paths. Impact: remote code execution likelihood noted as hig...

CVE-2021-21163

The CVE-2021-21163 issue affects Chromium/Google Chrome Reader Mode and is caused by insufficient data validation, allowing a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact (as stated): cros...

CVE-2021-21187

CVE-2021-21187 is a Chromium/Google Chrome URL formatting vulnerability caused by insufficient data validation in the URL formatting code. It allows a remote attacker to perform domain spoofing via IDN homographs when a crafted domain name is used, with impact described as spoofing and potential ...

CVE-2021-21205

CVE-2021-21205 affects Google Chrome on iOS prior to 90.0.4430.72. The issue is an insufficient policy enforcement in navigation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. According to the provided description, the vulnerability is severe (CVSSv3.1 scor...