Ecosystem
Azure Linux
13,277 known vulnerabilities.
Most affected packages
3,112 results · Clear filters · Feed
-
Medium 5.5
Use After Free in Wireshark
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
Out-of-bounds Write in Wireshark
3gpp phone log file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.3
Use of Uninitialized Variable in Wireshark
ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Heap-based Buffer Overflow in Wireshark
SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Heap-based Buffer Overflow in Wireshark
Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
Heap-based Buffer Overflow in Wireshark
UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
Heap-based Buffer Overflow in Wireshark
Catapult DCT2000 file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
Out-of-bounds Read in Wireshark
Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
NULL Pointer Dereference in Wireshark
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.3
BuildKit: Custom frontend could bypass Seccomp/AppArmor
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go trea…
-
Medium 6.3
tarfile extraction filter bypass allows creation of directories outside the destination
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate …
-
Medium 6.1
Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch
An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer t…
-
Medium 5.3
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessH…
-
Medium 6.0
`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials …
-
Medium 6.3
Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read.…
-
Medium 6.0
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA…
-
Medium 6.3
Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys direc…
-
Medium 5.1
Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name t…
-
Medium 5.1
crun follows rootfs /dev symlink while creating default devices
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configurat…
-
Medium 6.5
Samba: ctdb fails to do integrity checking of received packets
A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packe…
-
Medium 6.5
go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious c…
-
Medium 6.5
go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifyin…
-
Medium 5.5
Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and c…
-
Medium 5.9
Avoid quadratic complexity in resolvePath in net/url
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…
-
Medium 6.1
Fix Javascript regexp context tracking in html/template
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
-
Medium 4.2
Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives
The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations)…
-
Medium 5.3
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the …
-
Medium 6.5
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return val…
-
Medium 5.3
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences t…
-
Medium 6.5
rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. …
-
Medium 5.9
rsync < 3.5.0 Symlink Race Condition Directory Traversal
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manip…
-
Medium 4.7
rsync < 3.5.0 Symlink Race Condition via --remove-source-files
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file betwee…
-
Medium 6.3
rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write…
-
Medium 4.7
rsync < 3.5.0 Symlink Race Condition Information Disclosure
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically repl…
-
Medium 6.3
rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes …
-
Medium 5.3
rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the rece…
-
Medium 6.5
rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero…
-
Medium 6.5
rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent…
-
Medium 6.5
rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious …
-
Medium 5.3
rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When th…