CVE Vulnerability Catalog

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can...

Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.

A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.

Repeated use of the Unpacker after an error occurs may cause the process to crash with a SEGV. If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.

A divide-by-zero error was discovered in py-lmdb 0.97 in the mdb_env_open2 function when mdb_env_read_header obtains a zero value for a certain size field. This issue can be triggered by supplying a crafted data.mdb file.

GNU libidn2 before version 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels, allowing domain impersonation in some circumstances. An attacker can create a malicious domain that matches a target domain except for certain characters.

Vulnerability in CPAN 2.28 allows signature verification bypass. An attacker can supply unauthorized code that is treated as properly signed.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions over HTTPS. This allows man-in-the-middle attackers to replace downloaded packages with malicious ones.

Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.

A use-after-free and double-free vulnerability was found in the c-ares library in the query-completion handling path. The flaw occurs when a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted data.

In GCC 4.1 through 8, the stack_protect_prologue and stack_protect_epilogue functions for ARM targets generate instruction sequences that spill the address of the stack protector guard. This allows an attacker to bypass the stack protector mechanism.

In the POWER9 backend of GCC before version 10, optimization of multiple calls to the __builtin_darn intrinsic into a single call reduces the entropy of the random number generator. This occurs because a volatile operation was not specified.

The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

A critical vulnerability was found in SQLite3 up to version 3.43.0 in the sessionReadRecord function of ext/session/sqlite3session.c. Manipulation leads to a heap-based buffer overflow, potentially allowing remote code execution.

Wykryto podatność w openldap, która powoduje dereferencję wskaźnika null w funkcji ber_memalloc_x().

The vulnerability occurs when an application uses OAuth2::Client and the authorization server returns a redirect with a Location header in the form of a protocol-relative URI. In this case, OAuth2::Client#request may incorrectly resolve the redirect.