515 results · Clear filters · Feed
-
Medium 5.5
Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped
A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication.…
-
Medium 5.5
Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder
A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, t…
-
Medium 5.9
Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion
A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized …
-
Medium 5.5
Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames
A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copie…
-
Medium 5.5
Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound
A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attache…
-
Medium 6.3
Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links t…
-
Medium 6.3
Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can crea…
-
Medium 5.5
Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober
A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can …
-
Medium 5.5
Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value
A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero …
-
Medium 4.3
Busybox: use-after-free of requested_ipv6 in udhcpc6
A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options.…
-
Medium 5.3
Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this fla…
-
Medium 4.2
Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.
A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigg…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG …
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause…
-
Medium 6.6
Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, …
-
Medium 5.9CVE-2026-122056 Public exploit
Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service
A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corru…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that tri…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointe…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a …
-
Medium 5.3
Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via…
-
Medium 5.3
Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSE…
-
Medium 6.1
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within t…
-
Medium 6.2
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…
-
Medium 6.5
Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDV…
-
Medium 6.5
Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an inv…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of p…
-
Medium 6.5
Gcc: stack overflow in std::bitset on libstdc++
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an …
-
Medium 5.9
Gcc: integer wrap in `std
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the conta…
-
Medium 6.2
Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compil…
-
Medium 5.9
Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lea…
-
Medium 5.8
Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit thi…
-
Medium 4.3
Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigg…
-
Medium 4.3
Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostna…
-
Medium 6.8
Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive…
-
Medium 5.3
Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS…
-
Medium 5.3
Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DN…
-
Medium 6.8
Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains t…
-
Medium 6.5
389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service
A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An …
-
Medium 6.3
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byt…
-
Medium 5.4
Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to…