CVE Vulnerability Catalog

In GeoVision GV-LPC2211 V1.13, an administrator can set a username containing shell metacharacters that are executed as arbitrary root commands when the stored username is later deleted.

In GeoVision GV-LPC2211 V1.13, a Guest user can overwrite device configuration and replace the administrator password through SSVR.

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.

GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.

GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

In crun, when built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. This is a regression in crun 1.29 and affects crun >= 1.29.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.

An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function coines_read_stream_sensor_data() fails to validate the boundaries of the caller-provided destination buffer. Internally, comm_intf_process_stream_response() discards the requested number_of_samples argument and copies the entirety of the streaming ring buffer's accumulated data into coines_stream_rsp_buf. Subsequently, coines_read_stream_sensor_data() unconditionally executes a memcpy of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough. A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment. This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.

A heap-based buffer overflow in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The decoder trusts the packet length field from the external device and forwards it to the host response queue without validating the destination buffer bounds; a malicious USB or BLE peripheral can advertise a payload size up to ~3 KB, exceeding the default queue slot size of 255 bytes, resulting in an unbounded heap overwrite.

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c). The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables. When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9). An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher. This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer. The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.

A stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (in bhi385_parse.c). The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without bounds checks; copying into a fixed-size 17-byte stack buffer via memcpy with a length byte greater than 16 writes past the stack boundary, leading to firmware crash, DoS, or potentially arbitrary code execution.

A stack-based buffer overflow in the Bosch Sensortec BHI360 SensorAPI (C library) in versions up to and including commit d6b200416a. The vulnerability is in the FIFO parsing and debug logging subsystem within bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875); the parser trusts the first payload byte as the message length and copies that many bytes into a fixed-size 17-byte stack buffer via memcpy without bounds checking. A locally or physically positioned attacker can inject a crafted debug frame with a length byte exceeding 16, corrupting adjacent stack data including the saved return address; because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (DoS).

A vulnerability in Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.

A flaw in the Device Authorization Grant flow of Keycloak occurs because the token redemption process fails to check whether a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens.

A flaw in the skupper-router component of Red Hat Service Interconnect occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash.

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.