An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnulongname, causing an out-of-bounds read.
Last updated 31 March 2025
Last updated 31 March 2025
After tarclose(), libtar.c releases the memory pointed to by pointer t. After tarclose() is called in the list() function, it continues to use pointer t: freelonglinklongname(t->thbuf) . As a result, the released memory is used (use-after-free).
When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free).
A flaw in the Linux Kernel console driver found. When setting font with malicious data by ioctl PIOFONT, kernel will write memory out of bounds. To trigger the vulnerability user need to have access to console driver like if text mode being used through a generic VGA standard display.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/releases/5.10.127/vt-drop-old-font-ioctls.patch
atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.
When a file is processed, an infinite loop occurs in nextinline() of the morecurly() function.
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnulongname, causing an out-of-bounds read.
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnulonglink, causing an out-of-bounds read.
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807