CVE Vulnerability Catalog

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

A vulnerability in the XML::Parser library for Perl (up to version 2.45) causes a heap buffer overflow, leading to double free or corruption and crashes. The issue occurs in the parse_stream() function in Expat.xs when the :utf8 PerlIO layer is used, because Perl returns decoded characters while SvPV() expects raw bytes.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.

Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.

An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow, leading to a heap-based buffer overflow when processing sector allocation.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

Libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

A race condition in the Go database/sql package can overwrite expected results when a query is cancelled during the Scan method call while other queries run in parallel.

Insufficient granularity of access control in SEV firmware allows a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID meant for SEV-SNP guests, potentially leading to partial loss of confidentiality.

A vulnerability in the UEFI implementation within QEMU (or similar software) causes a heap overflow in the hardware module (hw/uefi). An attacker can exploit this flaw to gain unauthorized access or execute arbitrary code.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware allows a privileged attacker to modify the lock bit, potentially downgrading the firmware and compromising system integrity.