CVE Vulnerability Catalog

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can...

Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.

When curl is asked to use a `.netrc` file for credentials and to follow HTTP redirects, it could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests if the netrc file has an entry matching the redirect target hostname.

Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact: TLS and DTLS connections using raw public keys...

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure.

In GNU patch through version 2.7.6, there is a double free vulnerability in the another_hunk function in pch.c, which can cause a denial of service via a crafted patch file. This issue exists because of an incomplete fix for CVE-2018-6952.

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects applications using HSTS and URLs with the insecure HTTP:// scheme.

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces.

If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. This leads to abnormal termination of the running process, causing Denial of Service (DoS).

Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.

When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.

runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting certain operations.

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, but fails to specify that it does not for QUIC.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS.

A vulnerability has been identified in the Linux kernel within the rockchip module that may lead to ERR_PTR dereference in the rga_buf_init() function. The issue occurs when rga_get_frame() returns ERR_PTR(-EINVAL) due to an unsupported or invalid buffer type.

A vulnerability has been identified in the Linux kernel that leads to a memory leak in the atomic_destroy_state function. After several commits, slab memory increases as some drm_crtc_commit objects are not freed.

A vulnerability has been identified in the Linux kernel related to improper resource release in the most_register_interface() function. In cases of early failure before device registration, resources were not correctly released.