CVE Vulnerability Catalog

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. The vulnerability occurs only if the software is compiled in a certain way.

A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.

A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.

Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. A privileged user combined with a high complexity attack may enable this via local access.

If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. This leads to abnormal termination of the running process, causing Denial of Service (DoS).

Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

In GNU patch through version 2.7.6, there is a double free vulnerability in the another_hunk function in pch.c, which can cause a denial of service via a crafted patch file. This issue exists because of an incomplete fix for CVE-2018-6952.

The iscsi-initiator-utils package version 6.2.1.11-0.git4b3e853.el10 has a stack buffer overflow vulnerability in idbm_recinfo_config. A malicious iSCSI target can inject an extra configuration line into a persisted node record via a crafted SendTargets TargetName, later causing a stack buffer overflow.

Dalli's meta protocol request formatter writes some numeric arguments into memcached commands without converting them to integers. If an application passes an attacker-controlled String to one of these arguments, CRLF sequences in it are sent to memcached as additional commands on the same connection.

In FRRouting (FRR) up to version 7.3.1, when using the split-config feature, the init script creates an empty config file with world-readable default permissions, potentially leading to information leakage via frr.in and frrcommon.sh.in tools.

@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes. Inline shortcode attributes use another unanchored expression, which can lead to resource exhaustion.

On Red Hat Enterprise Linux systems with xdg-user-dirs before 0.15.5, the system umask policy is not honored when creating XDG user directories because Xsession sources xdg-user-dirs.sh before setting umask. This may lead to incorrect directory permissions.

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can...

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.

Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.