CVE Vulnerability Catalog

Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.

In MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, checking the wrong grantor privileges. A low-privileged attacker who can name another account can set that account's password.

In MariaDB, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump do not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can create an object with crafted identifiers or values and then execute injected SQL when the poisoned output is applied.

In Mailu, domain managers can enable spoofing for hosted domains they do not control. A malicious domain administrator can enable spoofing for another hosted domain and send emails authenticated with DKIM/SPF for domains they should not be able to.

In Mailu, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions.

In destructive_command_guard (dcg), nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. A hung PreToolUse hook fails open, allowing the destructive command to proceed.

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows an arbitrary user to read arbitrary files as root over DBus.

In libp2p-rust, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming prior subscription. A remote unauthenticated peer can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that can exhaust process memory and cause denial of service.

In SparkyFitness, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters, allowing execution of arbitrary OS commands with server process privileges.

In pupnp, parse_hostport synchronously calls getaddrinfo while processing attacker-supplied hostnames from inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service.

In libIEC61850, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. This causes a stack buffer over-read and copies those bytes into the caller-owned listName buffer, potentially crashing the server on a defineNamedVariableList request.

In libIEC61850, parseUserInformation checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path swallows the error, reads buffer[-1], resets parsing, and repeats the same state, leading to an infinite CPU loop or an out-of-bounds read and process abort.

In pupnp, raw_to_int in httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before storing it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser may accept a body length different from the declared value. Fixed in 2.0.2.

In pupnp, Transfer-Encoding: chunked causes the HTTP parser to leave content_length at zero while decoded bytes accumulate in msg.entity. The g_maxContentLength checks in http_RecvMessage do not enforce the same limit on decoded chunked bodies, so a remote peer can make the process buffer an entity larger than the configured maximum. Fixed in 2.0.2.

In pupnp, ixmlNode_compare passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp, though non-namespaced attributes legitimately leave them NULL. When ixmlElement_removeAttributeNode compares two distinct attributes with the same nodeName, the comparison dereferences NULL and crashes the process. Fixed in 2.0.2.

In TuxGuitar, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive (including the .tg file itself) whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class. When the file is opened, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with TuxGuitar process privileges. Fixed in 2.1.0.

In libIEC61850, alternateArrayAccess does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can crash servers whose data models contain arrays. Fixed in 1.6.2.

In libIEC61850, the MMS file service accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer, disclosing prior response data and protocol fragments to an unauthenticated remote client. Fixed in 1.6.2.