CVE-2022-21546

CVE-2022-21546 is a Linux kernel vulnerability affecting the SCSI target path. The issue arises in target_core_iblock/file when handling WRITE_SAME commands if the NDOB bit is set (NDOB indicates no data buffer) or when zero SG elements are sent. The kernel patch adds a common WRITE_SAME check fo...

CVE-2022-2867

libtiff’s tiffcrop utility has a uint32 underflow causing out-of-bounds read/write, enabling potential crash or exploitation when a user processes a crafted TIFF. The issue affects libtiff/tiffcrop across multiple distributions; remediation is to upgrade to a fixed libtiff version (examples in co...

CVE-2022-3599

LibTIFF 4.4.0 is affected by CVE-2022-3599 due to an out-of-bounds read in writeSingleSection of tools/tiffcrop.c:7345, enabling denial-of-service via a crafted TIFF file. The publicly documented fix is included in commit e8131125, and multiple advisories (Debian DSA/DLA, AlmaLinux security updat...

CVE-2022-3635

CVE-2022-3635 affects the Linux Kernel. The vulnerability is in the function tst_timer of drivers/atm/idt77252.c (IPsec component). It enables a use-after-free condition. A patch is recommended to fix the issue. The provided documents confirm the root cause and the vulnerable file/function, and d...

CVE-2022-40617

strongSwan before 5.9.8 is affected by a denial-of-service in the revocation plugin when processing a crafted end-entity certificate containing a CRL/OCSP URL pointing to an attacker‑controlled server that does not respond or misbehaves. This is documented across multiple advisories (Linux distri...

CVE-2024-36919

CVE-2024-36919 — Linux kernel (bnx2fc): The Unity/Miracle/NASL advisories confirm a patch that removes spin_lock_bh when releasing resources after upload in the bnx2fc session offload flow. Root cause: session resources are used by FW/driver during offload; after upload they are no longer needed,...

CVE-2024-36933

CVE-2024-36933 relates to the Linux kernel. The issue arises in nsh_gso_segment() when handling GSO packets with an outer header (example: ETH_P_8021AD) that NSH encapsulates. The inner protocol (e.g., NSH over Ethernet) can cause the outer header to be stripped or mispositioned due to misrestora...

CVE-2024-46853

CVE-2024-46853 is a Linux kernel issue corrected by updating to a patched kernel. The vulnerability stems from a KASAN slab-out-of-bounds bug in the nxp-fspi driver (spi/nxp-fspi) when handling data not aligned to 4 bytes written to TX FIFO. The issue could cause a read beyond the allocated regio...

CVE-2012-3489

CVE-2012-3489 affects PostgreSQL’s core server libxml2 support. The issue arises in the libxml2-based parsing path where the xml_parse function can be manipulated via an XML value that references a DTD or an external entity, enabling remote authenticated users to determine the existence of arbitr...

CVE-2015-7855

CVE-2015-7855 affects ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77. The decodenetnum() function can assert-botch when processing mode 6 or mode 7 packets with an unusually long data value, enabling a remote attacker to cause ntpd to crash (denial of service). Public references indicat...

CVE-2015-9542

CVE-2015-9542 affects pam_radius, where add_password in pam_radius_auth.c (pam_radius 1.4.0) does not properly check the input password length, leading to a stack-based buffer overflow during memcpy. This could crash the loading application and, depending on the host program, C library, and compi...

CVE-2016-1000339

CVE-2016-1000339 describes a cryptographic leakage in Bouncy Castle JCE Provider v1.55 and earlier, where the primary AES engine class was AESFastEngine. Because of the table-driven lookup, data channel timing could leak information about the AES key via table accesses; AESEngine also had leaks b...

CVE-2016-3477

CVE-2016-3477 affects Oracle MySQL Server (versions before 5.5.50, 5.6 before 5.6.30, 5.7 before 5.7.12) and MariaDB (before 5.5.50, 10.0.x before 10.0.26, 10.1.x before 10.1.15). The vulnerability is in the Server: Parser component and can allow a local user to impact confidentiality, integrity,...

CVE-2017-10118

CVE-2017-10118 affects Oracle Java SE/JRockit/JCE with a timing-channel vulnerability in ECDSA within the JCE component. A remote attacker could potentially recover private keys by observing timing differences, enabling unauthenticated network-remote exploitation on affected OpenJDK/JRockit confi...

CVE-2017-16548

The CVE-2017-16548 issue affects rsync 3.1.2 and 3.1.3-development: receive_xattr does not validate a trailing null in xattr names, allowing a remote attacker to cause a heap-based buffer over-read and crash the daemon. Evidence from multiple advisories confirms a denial-of-service/possible impac...

CVE-2017-5441

CVE-2017-5441 is a use-after-free in Mozilla Firefox (and related Mozilla products) that occurs when holding a text selection during scroll events, leading to a potentially exploitable crash. Affected: Firefox < 53 (and ESR lines), Thunderbird < 52.1, Firefox ESR

CVE-2017-7787

CVE-2017-7787 is a same-origin policy bypass vulnerability affecting Thunderbird and Firefox browsers. Affected products include Thunderbird versions older than 52.3, Firefox ESR older than 52.3, and Firefox older than 55. The issue occurs on pages with embedded iframes during page reloads, allow...

CVE-2017-7793

CVE-2017-7793 is a use-after-free in Thunderbird/Fetch API where the worker or window is freed while in use, leading to a potentially exploitable crash. Public details reference Thunderbird

CVE-2017-8105

CVE-2017-8105 affects FreeType 2 and earlier (up to 2017-03-24 release), with an out-of-bounds heap write in t1_decoder_parse_charstrings (psaux/t1decode.c). Connected sources confirm remote code execution risk and/or denial of service in several Linux distributions; impacted packages include fre...

CVE-2017-9062

Concisely: CVE-2017-9062 affects WordPress versions prior to 4.7.5, caused by improper handling of post meta data in the XML-RPC API. The underlying issue is in the set_custom_fields() path of wp-xmlrpc-server.php, which handles post meta data without sufficient validation. The vulnerability can ...

CVE-2017-9735

CVE-2017-9735 affects Jetty (Jetty 9.x family) via a timing-channel flaw in util/security/Password.java, enabling a remote attacker to infer sensitive information by measuring response times to incorrect password attempts. The issue can lead to unauthorized access and is described with a CVSS bas...

CVE-2018-19198

CVE-2018-19198 (uriparser) is an out-of-bounds write vulnerability in UriQuery.c triggered by mishandling the '&' character in certain contexts, affecting uriparser up to version 0.9.0. The issue is fixed in uriparser 0.9.0 and later (see multiple advisories: USNs/EULAs and vendor advisories refe...

CVE-2018-20181

CVE-2018-20181 affects rdesktop up to version 1.8.3, where an Integer Underflow triggers a Heap-Based Buffer Overflow in seamless_process(), causing memory corruption and potentially remote code execution. Public advisories confirm multiple CVEs in rdesktop with risk of denial of service, informa...

CVE-2018-8795

CVE-2018-8795 affects rdesktop up to and including v1.8.3. The vulnerability is an Integer Overflow that leads to a Heap-Based Buffer Overflow in process_bitmap_updates(), causing memory corruption and likely remote code execution when connecting to a malicious RDP server. Affected software: rdes...

CVE-2018-8796

CVE-2018-8796 affects rdesktop up to v1.8.3, with an out-of-bounds read in process_bitmap_updates() causing a denial of service (segfault). Remediation: upgrade to v1.8.4 or later (multiple advisories note the fix in upstream 1.8.4; Fedora/Debian/Arch Linux references).

CVE-2019-14562

CVE-2019-14562 affects the edk2 firmware (DxeImageVerificationHandler) with an integer overflow that may cause a denial of service via local access. Affected components are firmware/EDK II implementations. The vulnerability is demonstrated across multiple advisories: Debian LTS/DLA-2645-1 fixes e...

CVE-2019-18389

CVE-2019-18389 describes a heap-based buffer overflow in the virglrenderer transfer path. Specifically, vrend_renderer_transfer_write_iov in vrend_renderer.c (virglrenderer up to version 0.8.0) can be triggered by VIRGL_CCMD_RESOURCE_INLINE_WRITE, enabling denial of service and potentially guest‑...

CVE-2019-19330

CVE-2019-19330 affects the HAProxy HTTP/2 implementation. Affected component is the HTTP/2 header handling, which mishandles headers containing CR (0x0D), LF (0x0A), or NUL (0x00), enabling what is described as Intermediary Encapsulation Attacks. The vulnerability is exploitable via crafted HTTP/...

CVE-2019-20387

CVE-2019-20387: heap-based buffer over-read in repodata_schema2id() of libsolv (repodata.c) causing potential crash. Affected: Cloud Pak for Security (CP4S) versions 1.8.1.0, 1.8.0.0, 1.7.2.0. Root cause: last schema length shorter than input schema leading to over-read. Remediation: upgrade to C...

CVE-2019-7314

CVE-2019-7314 affects LIVE555 Live555’s liblivemedia. It is triggered by mishandling the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, leading to a use-after-free that can crash the RTSP server or cause unspecified impact. Affected history points to Live555 before 2019.0...

CVE-2020-13254

Django CVE-2020-13254 affects Django 2.2 (before 2.2.13) and 3.0 (before 3.0.7). Root cause: memcached backends that do not validate keys can produce key collisions with malformed cache keys, enabling potential data leakage. Multiple upstream advisories (Arch Linux ASA-202006-8; Debian DSA-4705-1...

CVE-2020-15565

Root cause: CVE-2020-15565 arises from insufficient cache write-back under VT-d when page tables are shared between IOMMU and CPU, requiring flushing of both CPU and IOMMU TLBs. A backport/backing fixes missed a necessary cache flush, leaving IOMMU updates potentially non-coherent. Affected produ...

CVE-2020-16293

Ghostscript CVE-2020-16293 is a null pointer dereference in compose_group_nonknockout_nonblend_isolated_allmask_common() (base/gxblend.c) in Ghostscript v9.50 that can cause a denial-of-service when processing a crafted PDF. The issue is corrected in Ghostscript v9.51. Affected product: Ghostscri...

CVE-2020-6384

CVE-2020-6384 is a use-after-free in WebAudio of Google Chrome/Chromium prior to version 80.0.3987.116, potentially enabling heap corruption via a crafted HTML page. Connected advisories confirm this issue is fixed in later Chromium/Chrome updates (e.g., Chromium 80.0.3987.132 and newer, with Red...

CVE-2020-6529

CVE-2020-6529 involves an inappropriate WebRTC implementation in Google Chrome versions prior to 84.0.4147.89. An attacker positioned on an privileged network could leak cross-origin data via a crafted HTML page. The CVE is tied to WebRTC data handling in Chrome, with a base impact characterized ...

CVE-2020-7663

The CVE-2020-7663 issue affects the ruby-websocket-extensions library (prior to 0.1.5). The parser can take quadratic time when processing a Sec-WebSocket-Extensions header containing an unclosed string parameter value with a repeating two‑byte sequence (backslash and a character), enabling Regex...

CVE-2021-21107

CVE-2021-21107 is a Use-After-Free in the Chromium drag-and-drop path affecting Google Chrome/Chromium on Linux prior to 87.0.4280.141. The vulnerability could allow a remote attacker who compromises the renderer process to escape the sandbox via a crafted HTML page. Public advisories (Arch Linux...

CVE-2021-21108

CVE-2021-21108 is a use-after-free in the Chromium media component prior to version 87.0.4280.141. The flaw could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Impact is described as enabling arbitrary code executio...

CVE-2021-21169

CVE-2021-21169 is a real vulnerability: an out-of-bounds memory access in the V8 JavaScript engine used by Chromium/Chrome. Connected advisories confirm the issue affects Chromium before version 89.0.4389.72 and has been fixed in newer Chrome/Chromium releases. Debian Security Advisories and Arch...

CVE-2021-28713

CVE-2021-28713 affects the hvc_xen (console) backend in Xen, where a malicious driver-domain can generate high-frequency events to exhaust guest interrupt handling and cause a Denial of Service. The initial entry notes three affected backends (blkfront CVE-2021-28711, netfront CVE-2021-28712, hvc...

CVE-2021-38300

CVE-2021-38300 affects the Linux kernel on MIPS through arch/mips/net/bpf_jit.c, where the BPF JIT can emit incorrect machine code when transforming unprivileged cBPF programs. Root cause: conditional branches can exceed the 128 KB limit, enabling a local user to execute arbitrary code in kernel ...

CVE-2022-27239

CVE-2022-27239 affects cifs-utils up to version 6.14, due to a stack-based buffer overflow when parsing the mount.cifs ip= argument, enabling local attackers to gain root privileges. A patched version is available (e.g., cifs-utils 6.14-2 and later per advisories). Remediation is to update to a f...

CVE-2022-34526

CVE-2022-34526 affects LibTIFF: a stack overflow in TIFFVGetField in Tiffsplit v4.4.0 can be triggered by processing crafted TIFF files via tiffsplit or tiffcrop, leading to DoS. The Connected documents confirm impact on the libtiff/tools, with advisories and mitigations from multiple vendors (e....

CVE-2022-3597

Technical details beyond the initial description are not provided in the supplied documents. Monitor for updates.

CVE-2023-2726

CVE-2023-2726 affects Google Chrome/Chromium prior to 113.0.5672.126, where an attacker could bypass the install dialog by convincing a user to install a malicious web app via a crafted HTML page. This is described as an Inappropriate implementation in WebApp Installs, with Chromium security seve...

CVE-2023-4355

CVE-2023-4355 affects Chromium-derived browsers (Google Chrome/Chromium) due to an out-of-bounds memory access in V8 that can lead to heap corruption via a crafted HTML page. The vulnerability is rated High severity (CVSS 3.1 base score 8.8) with network attack vector and user interaction require...

CVE-2023-52635

The CVE-2023-52635 entry concerns a Linux kernel devfreq timer race. Description: frequent governor switches (e.g., simple_ondemand and performance) on a devfreq device may race with timer cancellation and expiration, risking timer_list corruption when cancel_delayed_work_sync() is followed by ex...

CVE-2024-35789

CVE-2024-35789 – Linux kernel : Vulnerability in wifi/mac80211 VLAN handling where on moving a station out of a VLAN and deleting the VLAN, the fast_rx entry could still point to the VLAN netdev, enabling a use-after-free. The fixed behavior is to immediately call ieee80211_check_fast_rx after VL...

CVE-2024-35973

CVE-2024-35973 affects the Linux kernel's geneve code path. The issue arises from incomplete header validation in geneve_xmit_skb, where skb->protocol handling could leave pskb_inet_may_pull() with an uninitialized or unexpected value, potentially triggering an uninit-value during transmission...

CVE-2024-36939

CVE-2024-36939 affects the Linux kernel nfs subsystem. Root cause: rpc_proc_register() errors in init_nfs_fs() could be ignored, causing nfs_net_exit() to run during netns destruction and trigger warning paths. The issue was addressed by properly handling the rpc_proc_register() error in nfs_net_...