CVE Vulnerability Catalog

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position.

The 'id' utility in uutils coreutils incorrectly displays data in 'pretty print' mode when the real UID differs from the effective UID. The implementation mistakenly uses the effective GID instead of the effective UID when looking up the name of the effective user, leading to misleading output.

A logic error in the `ln` utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., `ln SOURCE... DIRECTORY`). While GNU ln treats filenames as raw bytes and creates links correctly, the uutils implementation enforces UTF-8 encoding.

The curl_url_get() function in libcurl offers punycode conversions to and from IDN. When converting a name that is exactly 256 bytes, libcurl reads outside a stack-based buffer when built with the macidn IDN backend.

Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact: TLS and DTLS connections using raw public keys...

The 'id' utility in uutils coreutils miscalculates the 'groups=' section of its output. The implementation uses the user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils.

The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).

A vulnerability in the rm utility of uutils coreutils allows bypassing safeguards that protect the current directory. The utility correctly refuses to delete . or .., but fails to recognize equivalent paths with trailing slashes, such as ./ or .///.

The touch utility in uutils coreutils is vulnerable to a TOCTOU race condition during file creation. After identifying a missing path, the utility later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file.

An improper initialization vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware allows an admin-privileged attacker to corrupt RMP-covered memory, potentially leading to loss of guest memory integrity.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation, which a local attacker with write access to the destination directory can exploit.

A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.

A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644).

An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.

The vulnerability in the Nokogiri library affects the protected copy helper used by Node#dup and #clone methods. It unwrapped the source argument as an xmlNode without a type check, causing an out-of-bounds read on xmlNs structure and process crash when a non-Node object (e.g. Namespace) was supplied. Version 1.19.4 adds a type check and raises TypeError.

Insufficient granularity of access control in SEV firmware allows a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID meant for SEV-SNP guests, potentially leading to partial loss of confidentiality.