CVE Vulnerability Catalog

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.

GNU Midnight Commander 4.8.29-146-g299d9a2fb was found to contain a NULL pointer dereference in the function x_error_handler() at tty/x11conn.c. NOTE: this is disputed because it should be categorized as a usability problem (an X operation silently fails).

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

A heap-buffer-overflow vulnerability was found in LibTIFF in the extractImageSection() function at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801, which can lead to denial of service via a crafted TIFF file.

In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.

Sudo VISudo version 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when using the "-ImgDir" command line option on a directory containing 1048576 files.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames, it calls free() on an uninitialized pointer, leading to a segmentation fault and potential denial of service.

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.

W jądrze Linuxa zidentyfikowano podatność, która dotyczy potencjalnego dereferencji wskaźnika NULL w funkcji zd_mac_tx_to_dev(). Problem ten został rozwiązany w aktualizacji.

W jądrze Linuxa naprawiono podatność związaną z funkcją bpf_arch_text_poke(), która mogła nieprawidłowo obsługiwać sytuację, gdy nowy adres był równy NULL. Poprzednia poprawka usunęła istotny fragment kodu, co mogło prowadzić do problemów z wskaźnikami.

W jądrze Linuxa naprawiono podatność związaną z dereferencją wskaźnika null w funkcji l2cap_sock_resume_cb(). Problem ten został zgłoszony przez syzbot.

W jądrze Linuxa naprawiono podatność związaną z logiką czyszczenia w emulacji wywołań hypercall schedop poll w KVM dla architektury x86/xen. Problem występował podczas, gdy maszyna wirtualna monitorowała hosta dla więcej niż jednego kanału zdarzeń.

W jądrze Linuxa rozwiązano podatność, która występowała w funkcji htb_lookup_leaf, gdy napotykała pusty rbtree. W takim przypadku mogło dojść do wywołania błędu BUG_ON.