Ecosystem
Ubuntu
61,691 known vulnerabilities.
Most affected packages
61,260 results · Feed
-
Low 3.7
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffer…
-
High 7.5
cpp-httplib: Cookie header leaked on cross-origin redirect
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail…
-
Medium 5.7
Evolution-data-server: local file disclosure via attach file:// uris
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file pat…
-
Medium 6.5
Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
-
Medium 6.5
Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
-
Medium 6.5
Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
-
Medium 6.5
Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
-
Medium 6.5
Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
-
Medium 6.5
Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
-
High 8.8
Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
-
High 8.8
Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
-
High 8.8
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A seco…
-
High 7.5
Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list look…
-
Medium 5.9
Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 ma…
-
Medium 5.9
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar…
-
Medium 6.3
TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there…
-
High 8.2
TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. Th…
-
High 8.6
Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can un…
-
High 8.2
Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
-
High 7.8
Dpdk: dpdk: double offset bug in vhost log mapping calculation
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
-
High 7.8
Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
-
Medium 5.3
RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is v…
-
Medium 6.0
RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the num…
-
Medium 5.3
RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value b…
-
High 8.0
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to th…
-
Low 3.6
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_transla…
-
Medium 6.5
Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
-
Medium 6.4
Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between …
-
Low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary…
-
High 7.0
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privil…
-
Low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_l…
-
High 8.2
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet …
-
Medium 5.1
Angular DevTools (Local DoS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages fr…
-
Medium 5.3
Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separato…
-
Medium 5.5
unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-ran…
-
Medium 6.1
MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and c…
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an …
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigne…
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on un…
-
Low 3.3
CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes AD…