CVE-2016-5195

CVE-2016-5195 (Dirty COW) : A race condition in the Linux kernel’s memory management (mm/gup.c) allows a local user to gain write access to read‑only mappings via a faulty copy‑on‑write handling. Affected: kernel 2.x–4.x prior to 4.8.3. Exploitation was observed in the wild around Oct 2016. Impac...

CVE-2026-31431

CVE-2026-31431 is a local privilege escalation in the Linux kernel’s algif_aead/AF_ALG path. The root cause is an in-place operation bug in the AEAD handling, which can be exercised via AF_ALG sockets with the authencesn algorithm and splice() to corrupt the kernel page cache of readable files wi...

CVE-2019-11477

CVE-2019-11477 (SACK Panic) is a Linux kernel TCP vulnerability where crafted SACK blocks can trigger an integer overflow, potentially causing a kernel crash and DoS. CVE-2019-11478/11479 describe related DoS via SACK handling and low MSS. In practice, Arista discloses affected products (EOS, Clo...

CVE-2020-10711

The CVE-2020-10711 entry concerns a NULL pointer dereference in the Linux kernel SELinux subprocess during CIPSO category bitmap import. Affected are kernel versions before 5.7; processing the CIPSO restricted bitmap tag in cipso_v4_parsetag_rbm sets a security attribute indicating the bitmap exi...

CVE-2018-13405

CVE-2018-13405 involves the Linux kernel inode_init_owner() logic where, in a scenario with an SGID directory and a writably user who is not in that group, a local user could create a plain file with the SGID group ownership and executable bits, effectively escalating privileges. Connected docume...

CVE-2019-11478

CVE-2019-11478 describes a DoS in the Linux kernel TCP SACK handling where the TCP retransmission queue can fragment, leading to degraded performance or denial of service when processing crafted SACK sequences. The initial entry notes a fixed commit f070ef2ac66716357066b683fb0baf55f8191a2e and st...

CVE-2019-9506

CVE-2019-9506 affects Bluetooth KNOB (Key Negotiation of Bluetooth) by allowing nearby attackers to influence encryption key length during BR/EDR negotiation, enabling potential eavesdropping and ciphertext injection. Connected sources show this vulnerability being acknowledged by Apple across iO...

CVE-2021-3669

CVE-2021-3669 is a Linux kernel vulnerability where measuring shared memory usage does not scale with large shared memory segment counts, enabling resource exhaustion and DoS. Connected sources confirm the issue affects multiple kernel versions and distributions, with remediations following vendo...

CVE-2019-10126

CVE-2019-10126 affects the Linux kernel Marvell mwifiex wireless kernel driver. The issue is a heap-based buffer overflow in mwifiex_uap_parse_tail_ies (drivers/net/wireless/marvell/mwifiex/ie.c) that can lead to memory corruption. Public documents in the Connected set identify the affected compo...

CVE-2024-0229

CVE-2024-0229 affects the X.Org server (xorg-x11-server). The flaw is an out-of-bounds memory access triggered when a device frozen by a sync grab is reattached to a different master device, potentially causing an application crash, local privilege escalation, or remote code execution in SSH X11 ...

CVE-2020-14355

Summary of CVE-2020-14355 : Multiple buffer overflow vulnerabilities were found in the QUIC image decoding path of SPICE, affecting both client and server components (spice-gtk, spice-server, and shared spice-common code). The flaws could allow a remote attacker to send crafted QUIC messages that...

CVE-2023-47038

CVE-2023-47038 affects perl 5.30.0–5.38.0 and describes a heap-based buffer overflow caused by writing past buffer end when compiling a crafted regular expression via a user-defined Unicode property. Multiple connected advisories document this as a high-severity issue with potential impact to con...

CVE-2023-0494

The CVE-2023-0494 entry concerns X.Org X server: a dangling pointer in DeepCopyPointerClasses can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read/write freed memory, enabling local privilege elevation on privileged X servers and remote code execution for SSH X forwarding...

CVE-2021-3609

CVE-2021-3609 is a local privilege-escalation flaw in the Linux kernel CAN BCM subsystem. A race in net/can/bcm.c between bcm_rx_handler() and bcm_release() can free bcm_op/bcm_sock structures while the handler runs, enabling use-after-free and root access. Public advisories consistently describe...

CVE-2021-20316

CVE-2021-20316 affects Samba: an authenticated attacker can read or modify share metadata due to a flaw in handling file/directory metadata, potentially enabling operations outside the intended share. Affected Samba versions exist in multiple OS packages; several connected advisories note that a ...

CVE-2017-10661

CVE-2017-10661 is a race condition in Linux kernel timerfd (fs/timerfd.c) that affects versions before 4.10.15. The flaw arises from improper protection of the might_cancel queue during concurrent timerfd operations, enabling local attackers to cause a denial of service or gain privileges via lis...

CVE-2018-1049

CVE-2018-1049 describes a race condition in systemd prior to version 234 between .mount and .automount units, where automount requests from the kernel may not be serviced, causing the mountpoint to hang for affected processes and leading to denial of service. Connected advisories and Nessus plugi...

CVE-2021-3570

The CVE-2021-3570 entry concerns linuxptp’s ptp4l, where a missing length check on forwarded PTP messages allows a remote attacker to trigger information disclosure, crash, or potentially remote code execution. Affected are linuxptp versions prior to 3.1.1, 2.0.1, 1.9.3, 1.8.1, 1.7.1, 1.6.1, and ...

CVE-2011-1093

CVE-2011-1093 affects the Linux kernel’s Datagram Congestion Control Protocol (DCCP). The vulnerable code path is dccp_rcv_state_process in net/dccp/input.c, which mishandles packets for a CLOSED endpoint. An attacker can trigger a NULL pointer dereference and OOPS by sending a DCCP-Close packet ...

CVE-2020-1045

CVE-2020-1045 is a Security Feature Bypass in Microsoft ASP.NET Core where the cookie parser decodes entire cookie strings, allowing a attacker to set a second cookie with a percent-encoded name. Documented impact is a bypass of security controls via crafted encoded cookie names; CVSS v3.1 base s...

CVE-2023-3972

CVE-2023-3972 affects the insights-client in TencentOS Server (2 and 3). The issue arises from insecure file operations/handling of temporary files, allowing an unprivileged local user to create the /var/tmp/insights-client directory before root registers the insights-client. After registration b...

CVE-2018-16878

CVE-2018-16878 (and related Pacemaker issues) affect Pacemaker up to v2.0.1. Concrete items in connected docs: CVE-2018-16877 (insufficient local IPC client-server authentication enabling local privesc), CVE-2018-16878 (insufficient verification enabling DoS via uncontrolled process preference), ...

CVE-2014-9584

CVE-2014-9584 affects the Linux kernel where the function parse_rock_ridge_inode_internal in fs/isofs/rock.c does not validate a length value in the ER System Use Field, enabling local users to obtain sensitive kernel memory via a crafted iso9660 image. This vulnerability exists in kernels before...

CVE-2016-9901

CVE-2016-9901 affects Mozilla Firefox and Firefox ESR. Un-sanitized HTML from the Pocket server could execute JavaScript in the unprivileged about:pocket-saved context, gaining access to Pocket’s messaging API via HTML injection. Impact stated as high/critical by CVSS. Remediation: update to Fire...

CVE-2014-9585

CVE-2014-9585 affects Linux kernels up to 3.18.2. The vdso_addr code in arch/x86/vdso/vma.c can misselect vDSO memory, enabling local users to bypass ASLR by guessing a PMD-end location. Exploitation details and patches/fixes are not provided in the connected documents; monitor advisories for rem...

CVE-2017-7824

The CVE-2017-7824 issue is a buffer overflow in ANGLE used for WebGL rendering in Thunderbird before 52.4. It results from an incorrect value passed during checks in the ANGLE library, leading to a potentially exploitable crash. Affected products include Thunderbird

CVE-2013-0775

CVE-2013-0775 is a use-after-free vulnerability in Firefox’s image handling. Specifically, it concerns nsImageLoadingContent::OnStopContainer and affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. ...

CVE-2013-0783

CVE-2013-0783 refers to multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (Firefox <19.0, ESR 17.x <17.0.3, Thunderbird <17.0.3, SeaMonkey

CVE-2024-3183

CVE-2024-3183 affects FreeIPA and relates to Kerberos TGS-REQs: tickets for a target principal are encrypted with that principal’s key, which for user principals is derived from a per-principal salt and password. If a principal is compromised, an attacker could offline-brute-force passwords for o...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2011-2022

The CVE-2011-2022 issue affects the Linux kernel (drivers/char/agp/generic.c) prior to 2.6.38.5. The vulnerability is due to failure to validate a start parameter in the agp_generic_remove_memory function, enabling local users to gain privileges or cause a denial of service (system crash) via a c...

CVE-2011-1745

The CVE-2011-1745 entry affects the Linux kernel: an integer overflow in the agp_generic_insert_memory function (drivers/char/agp/generic.c) in kernels before 2.6.38.5. This allows local users to gain privileges or cause a denial of service via a crafted AGPIOC_BIND agp_ioctl call. Affected platf...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2011-1746

The CVE affects the Linux kernel prior to 2.6.38.5, specifically the AGP subsystem in drivers/char/agp/generic.c. It is caused by multiple integer overflows in the functions agp_allocate_memory and agp_create_user_memory, allowing local users to trigger buffer overflows and potentially crash the ...

CVE-2011-1182

CVE-2011-1182 affects the Linux kernel’s signal handling: kernel/signal.c before 2.6.39 allows local users to spoof the UID and PID of a signal sender via sigqueueinfo. Affected in MiracleLinux 3 (kernel 2.6.18-274.1.AXS3) per AXSA-2011-313:06; the issue is described as a kill-signal spoofing vul...

CVE-2013-0772

CVE-2013-0772 is a memory-safety issue in Mozilla's image rendering: RasterImage::DrawFrameTo allows out-of-bounds reads in crafted GIFs, enabling possible information disclosure or denial of service. Affected products and versions per connected docs: Mozilla Firefox up to version 19.0 (prior to ...

CVE-2018-14638

The CVE-2018-14638 issue affects 389-ds-base; the root cause is a crash in delete_passwdPolicy when persistent search connections terminate unexpectedly, leading to remote denial of service. The vulnerability is described for versions before 1.3.8.4-13, and multiple connected advisories note fixe...

CVE-2011-2213

The CVE-2011-2213 issue concerns the Linux kernel vulnerability in inet_diag_bc_audit (net/ipv4/inet_diag.c) present before 2.6.39.3. Affected component audits INET_DIAG bytecode and, when processing crafted INET_DIAG_REQ_BYTECODE messages (e.g., an INET_DIAG_BC_JMP with a zero yes value), allows...

CVE-2017-7829

CVE-2017-7829 is a Thunderbird vulnerability in which the sender’s address can be spoofed. The real sender is hidden if a null character precedes the display string, causing the recipient to see an arbitrary address. Affected product is Mozilla Thunderbird prior to 52.5.2. The issue is described ...

CVE-2011-1593

CVE-2011-1593 affects the Linux kernel before 2.6.38.4, where multiple integer overflows in the next_pidmap function (kernel/pid.c) allow a local user to crash the system via crafted getdents or readdir calls. The connected advisories confirm the affected component and the root cause (integer ove...

CVE-2011-2492

CVE-2011-2492 affects the Linux kernel Bluetooth subsystem prior to 3.0-rc4, where certain data structures are not properly initialized. The flaw is exploited via a crafted getsockopt system call in the l2cap_sock_getsockopt_old and rfcomm_sock_getsockopt_old paths, enabling local users to obtain...

CVE-2025-31277

CVE-2025-31277 is a memory handling vulnerability in WebKit/WebKitGTK affecting Apple platforms (Safari, iOS, iPadOS, macOS, tvOS, visionOS, watchOS) where processing malicious web content could lead to memory corruption. The issue’s root cause is described as memory handling defects that allow m...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2017-7847

Mozilla Thunderbird prior to 52.5.2 is affected by CVE-2017-7847 through crafted CSS in an RSS feed that can leak local path strings (potentially including user names). The underlying issue is leakage via RSS processing of CSS. Impact is information disclosure; exploitation details are not provid...

CVE-2019-11811

CVE-2019-11811 affects the Linux kernel up to version 5.0.4 (pre-5.0.4). The issue is a use-after-free on read access to /proc/ioports after the ipmi_si driver is removed, tied to ipmi_si_intf.c, ipmi_si_mem_io.c, and ipmi_si_port_io.c. Impact: local privilege/escalation risk if an attacker can u...

CVE-2012-0260

CVE-2012-0260 affects ImageMagick prior to 6.7.6-3: the JPEGWarningHandler in coders/jpeg.c can be triggered by a crafted JPEG with specific restart marker sequences, causing memory consumption DoS. Affected versions are ImageMagick before 6.7.6-3; remediation is to upgrade to a fixed release (6....

CVE-2025-62230

CVE-2025-62230 affects the X.Org X server family (Xwayland/Xkb handling). The issue is a use-after-free in the Xkb client resource removal path when a client disconnects, caused by improper cleanup of Xkb resources that frees the XkbInterest data but not the associated resource, potentially leadi...

CVE-2025-62231

The CVE-2025-62231 issue is a use-after-free/value overflow in the X.Org X server’s XkbSetCompatMap() that can overflow an unsigned short and cause memory corruption or a crash. Public advisories (ALMAS/ALAS) associate this with the Xorg X11/Xwayland stack and Xorg-server-Xwayland/Xorg components...