Platform
Linux
20,653 known vulnerabilities.
2,383 results · Clear filters · Feed
-
Medium 6.5
Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, t…
-
Medium 4.4
Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. T…
-
Medium 6.5
Flatpak: flatpak: arbitrary write in host context via flatpak build-init
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the t…
-
Medium 5.4
Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly retu…
-
Medium 5.5
Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing
A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted …
-
Medium 4.1
Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write
An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredi…
-
Medium 5.3
Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while b…
-
Medium 6.1
Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership change…
-
Medium 6.0
Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and…
-
Medium 6.0
Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link …
-
Medium 5.5
Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-…
-
Medium 5.0
Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `insta…
-
Medium 5.0
Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-lin…
-
Medium 5.9
Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash
A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root p…
-
Medium 6.8
Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to inc…
-
Medium 5.5
Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)
A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively lo…
-
Medium 5.5
Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to …
-
Medium 5.1
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
Medium 5.1
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
Medium 6.8
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
Medium 5.1
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
Medium 5.9
Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK wit…
-
Medium 5.5
Podman: arbitrary file write when importing oci archive
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
-
Medium 4.4
Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.Unpa…
-
Medium 4.5
Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah its…
-
Medium 6.1
Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit th…
-
Medium 4.0
Sssd: sssd: denial of service in nss responder via crafted zero-length requests
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable…
-
Medium 5.5
Sssd: sssd: local denial of service due to null pointer dereference in pam responder
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is en…
-
Medium 4.0
Sssd: sssd: denial of service via malformed pam v1 requests
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending…
-
Medium 4.0
Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead …
-
Medium 6.2
Device-mapper-multipath: local denial of service via blocking ipc send operations
A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, …
-
Medium 6.1
Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteC…
-
Medium 5.5
Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile w…
-
Medium 4.4
Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This…
-
Medium 6.9
Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML met…
-
Medium 6.3
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an a…
-
Medium 6.5
Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 2…
-
Medium 5.6
Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fre…
-
Medium 5.6
Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29…
-
Medium 4.3
Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with…