CVE Vulnerability Catalog

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks and missing length checks on the RSA path can overflow a host buffer in the vhost-crypto backend.

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

In Redash from 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin, and when HTTP Basic Auth was configured, the request also forwarded those credentials. This issue is fixed in version 26.9.0.

In evolution-data-server, calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally, allowing an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to.

Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection. This issue affects MDTF from n/a through 1.3.9.

Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate, saturating a CPU core and stalling every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write files to arbitrary locations writable by the Appium process, potentially leading to code execution. This issue is fixed in version 7.2.6.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.

An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.

An infinite loop vulnerability in the erl_tar module (Erlang OTP stdlib) and in copies of this code shipped with hex_core, Hex, and rebar3. A crafted tar archive containing a malicious GNU sparse member causes the extracting process to loop indefinitely, keeping one scheduler busy. The issue affects OTP from 29.0 before 29.1.2, rebar3 from 3.27.1 before 3.28.0, stdlib from 8.0 before 8.1.1, hex from 2.4.2 before 2.5.3, and hex_core from 0.14.0 before 0.20.1.

An LDAP filter injection vulnerability in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.

The STM32WBA IEEE 802.15.4 driver computed the packet length as the frame length minus the FCS length without first verifying that the reported length could hold an FCS. A reported length of 0 or 1 caused a uint8_t underflow to 254 or 255, and the only bound (__ASSERT_NO_MSG) was compiled out in the default production configuration. As a result, the driver read roughly 128 bytes past the radio receive buffer and copied that adjacent memory into a network packet submitted to the networking stack.

The CC1200 sub-GHz IEEE 802.15.4 driver reads the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity(), which only enforces a lower bound (pkt_len < 3) and never bounds large values. Because the radio is configured for variable packet length with PKT_LEN = 0xFF, the over-the-air length byte (0-255) reaches net_pkt_rx_alloc_with_buffer() and the SPI burst read unclamped. An unauthenticated attacker within radio range can transmit a frame with a length byte above the IEEE 802.15.4 maximum of 127, causing a write past the end of a network buffer fragment.

The NXP KW41Z IEEE 802.15.4 driver (kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c) computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t. Because the frame length comes from the unauthenticated RX_FRAME_LENGTH field of the ZLL IRQSTS register and only zero was rejected, a reported length of one underflowed to pkt_len == 255. This caused 255 bytes to be written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory and reading past the PKT_BUFFER_RX register array.