CVE Vulnerability Catalog

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. It is recommended to use the maintained package github.com/ProtonMail/go-crypto/openpgp instead.

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

In the Linux kernel, the bnge driver has a vulnerability where a return statement is missing after auxiliary_device_uninit() in the error path. After auxiliary_device_add() fails, execution continues, potentially leading to use-after-free.

Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.

In CPython, the venv module and CLI do not properly quote paths when creating a virtual environment, allowing injection of commands into activation scripts (e.g., source venv/bin/activate). This enables arbitrary code execution upon activation.

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.

The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the cil_reset_classpermission function, called from cil_reset_classperms_set and cil_reset_classperms_list. This could lead to unexpected behavior or potential exploitation by an attacker.

The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __verify_map_perm_classperms and hashtab_map. This could lead to unexpected behavior or potential exploitation by an attacker.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, when using streams with a configured proxy and the request_fulluri option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to perform arbitrary HTTP requests through the proxy.

The vulnerability in the Nokogiri library affects the `Nokogiri::XML::Node#do_xinclude` method, which during XInclude processing removes `<xi:include>` nodes along with their children (e.g., `<xi:fallback>`) and declared namespaces. If an application previously accessed these nodes, unexpected behavior may occur.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.

A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.

The vulnerability in the Nokogiri library affects the protected copy helper used by Node#dup and #clone methods. It unwrapped the source argument as an xmlNode without a type check, causing an out-of-bounds read on xmlNs structure and process crash when a non-Node object (e.g. Namespace) was supplied. Version 1.19.4 adds a type check and raises TypeError.