Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,811

CVE-2021-39254

ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize()

A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Advanced Virtualization and 2 more
CVE-2023-3341

A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Fedoraproject Isc and 1 more
Products
Debian Linux Fedora Bind and 6 more
CVE-2023-2603

libcap: Integer Overflow in _libcap_strdup()

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libcap Project and 1 more
Products
Debian Linux Fedora Libcap and 2 more
CVE-2022-4904

c-ares: buffer overflow in config_sortlist() due to missing string length check

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

CVSS 3.1 · 8.6 High EPSS 1.2% KEV · Not listed
Vendors
C-ares Project Fedoraproject Redhat
Products
C-ares Fedora Enterprise Linux and 3 more
CVE-2022-30789

ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2023-38039

curl: out of heap memory issue due to missing limit on header quantity

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

CVSS 3.1 · 7.5 High EPSS 56.2% KEV · Not listed
Vendors
Fedoraproject Haxx Microsoft and 1 more
Products
Fedora Curl Windows 10 1809 and 8 more
CVE-2024-27008

drm: nv04: Fix out of bounds access

In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 1 more