CVE Vulnerability Catalog

In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

SSH clients that receive SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is a limit on the location value size to 1024 bytes, which may be insufficient per RFC.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, the HTTP request module incorrectly parses folded headers in HTTP responses, which may lead to misinterpreting the response and using incorrect MIME headers.

Vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. The HTTP_REDIRECT_STATUS variable used to check if CGI is run by the HTTP server can be controlled by the request submitter via HTTP headers.

A vulnerability in GNU Nano allows privilege escalation through an insecure temporary file. If Nano is killed while editing, it saves an emergency file with the permissions of the running user.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

The PAM module pam_cap.so of libcap supports group names starting with “@”, but during parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security issues.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.

In sshd in OpenSSH before version 10.0, the DisableForwarding directive does not adhere to documentation, failing to disable X11 and agent forwarding.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect.

Vulnerability in the PDO PostgreSQL driver for PHP causes an invalid character sequence (e.g., \x99) in a prepared statement parameter to lead to quoting errors when PDO::ATTR_EMULATE_PREPARES is enabled. Affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1.

In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.

In xmllint from libxml2 before versions 2.11.8 and 2.12.7, formatting error messages with --htmlout can cause a buffer over-read in xmlHTMLPrintFileContext.

A heap-buffer-overflow vulnerability was found in LibTIFF in the extractImageSection() function at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801, which can lead to denial of service via a crafted TIFF file.

In libxml2 before 2.11.0, xmlXIncludeAddNode in xinclude.c has a use-after-free vulnerability.

In libxml2 before 2.12.10 and 2.13.6, a use-after-free exists in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.