Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENTCUTTEXT message, which triggers an infinite loop.
Fixed bug (Uninitialized read in gdImageCreateFromXbm) (CVE-2019-11038).
GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file, related to the (1) DrawImage function in magick/render.c, (2) SVGStartElement function in coders/svg.c, and (3) TraceArcPath function in magick/render.c.
The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.
The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.
Avoid a memory leak in rle file handling.
CVE assignment:
http://seclists.org/oss-sec/2016/q2/459
Upstream patches related to rle file handling:
https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=74b6cb6000b678e3e7bac553177052cb15b02cb6 https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=36ed9419a68cb1356b1843b48cc12788179cdaee https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=2d90693af41a363a988a9db3a91a15f9ca7c7370 https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=90a405ba3e329e7e080addadac377dd4235671d3
A vulnerability was found in Linux kernel. There is an information leak in file "sound/core/timer.c" of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copytouser(), resulting a kernel leak.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Last updated 24 July 2024
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
Last updated 24 July 2024
Destroy of network interface with huge number of ipv4 addresses keeps rtnllock for a very long time (up to hour). It blocks many network related operations, including for example creation of new incoming ssh connections.
The problem is especially important for containers, container owner have enough permission to enable this trigger and then can block network access on whole host node.
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git/commit/?id=fbd40ea0180a2d328c5adc61414dc8bab9335ce2
References:
http://seclists.org/oss-sec/2016/q1/643
CVE assignment:
http://seclists.org/oss-sec/2016/q1/647
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required iowarrior driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283390
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required gtco module. The kernel would panic causing null pointer dereference attempting to access invalid USB device descriptors.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283385
Intended to be public via:
http://seclists.org/bugtraq/2016/Mar/86
Public via:
https://bugzilla.redhat.com/showbug.cgi?id=1283385
Proposed upstream patch (linux-usb@ and linux-input@ lists):
http://www.spinics.net/lists/linux-usb/msg137950.html http://www.spinics.net/lists/linux-input/msg43786.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=162f98dea487206d9ab79fc12ed64700667a894d
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required powermate driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283384
Public via:
http://seclists.org/bugtraq/2016/Mar/85
This was assigned CVE-2016-2186 by Red Hat.
A flaw was found in in the Linux kernel's USB device management code which could cause a kernel panic when a device which required atiremote2 kernel module. The kernel would panic causing null pointer dereference attempting to access a non existent interface descriptor. The atiremote2 driver assumes that there will be at least two interface-descriptors with associated endpoint-descriptors.
Product bugs:
https://bugzilla.redhat.com/showbug.cgi?id=1283362 https://bugzilla.redhat.com/showbug.cgi?id=1283363
Public via:
http://seclists.org/bugtraq/2016/Mar/90
Red Hat assigned CVE-2016-2185 to this issue.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required cypressm8 driver. The kernel would panic causing null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283368
Kernel crash occurs when presented a buggy USB device which requires digiacceleport driver, causing null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283378
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
A flaw was found in the Linux kernel handling when a buggy USB device is attached attempting to use the cdcacm kernel module. This flaw would cause the kernel to panic by a null pointer dereference.
Public via:
http://seclists.org/bugtraq/2016/Mar/54
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/605
http://seclists.org/oss-sec/2016/q1/622
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8835ba4a39cf53f705417b3b3a94eb067673f2c9
fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.
A local kernel crash on invalid USB device requiring the visor driver was reported. The treoattach() function of the [visor] driver, which is called during the driver initialization process, was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 554 #define COPYPORT(dest, src) \ 555 do { \ 556 int i; \ 557 \ 558 for (i = 0; i < ARRAYSIZE(src->readurbs); ++i) { \ 559 dest->readurbs[i] = src->readurbs[i]; \ / Possible Nullpointer-Dereference / 560 dest->readurbs[i]->context = dest; \ 561 dest->bulkinbuffers[i] = src->bulkinbuffers[i]; \ 562 } \ 563 dest->readurb = src->readurb; \ 564 dest->bulkinendpointAddress = src->bulkinendpointAddress;\ 565 dest->bulkinbuffer = src->bulkinbuffer; \ 566 dest->bulkinsize = src->bulkinsize; \ 567 dest->interruptinurb = src->interruptinurb; \ 568 dest->interruptinurb->context = dest; \ 569 dest->interruptinendpointAddress = \ 570 src->interruptinendpointAddress;\ 571 dest->interruptinbuffer = src->interruptinbuffer; \ 572 } while (0); 573 574 swapport = kmalloc(sizeof(swapport), GFPKERNEL); 575 if (!swapport) 576 return -ENOMEM; 577 COPYPORT(swapport, serial->port[0]); / no sanity-check! / 578 COPYPORT(serial->port[0], serial->port[1]); / no sanity-check! / 579 COPYPORT(serial->port[1], swapport); / no sanity-check! / ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283374
An upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Public via: http://seclists.org/bugtraq/2016/Mar/86
CVE-ID request and assignment: http://seclists.org/oss-sec/2016/q1/456 http://seclists.org/oss-sec/2016/q1/458
Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.
Buffer overflow in the gethostbynamer and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
Last updated 15 January 2025
GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AFINET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.
GraphicsMagick, a comprehensive image processing package, is found to have a vulnerability which can be exploited by malicious people to cause a Denial of Service (DoS).
The vulnerability is caused due to an error within the "ExportAlphaQuantumType()" function found in magick/export.c when exporting 8-bit RGBA images, which can be exploited to cause a crash.
The vulnerability is reported in versions prior to 1.3.18, Fedora 19 already ships with 1.3.18, so it doesn't seem to be affected.
References: https://bugs.gentoo.org/showbug.cgi?id=488050