Search CVE reports
1501 – 1510 of 47443 results
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided...
1 affected package
pcs
| Package | 24.04 LTS |
|---|---|
| pcs | Vulnerable |
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with...
1 affected package
t-digest
| Package | 24.04 LTS |
|---|---|
| t-digest | Needs evaluation |
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default...
1 affected package
crun
| Package | 24.04 LTS |
|---|---|
| crun | Needs evaluation |
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback....
1 affected package
crun
| Package | 24.04 LTS |
|---|---|
| crun | Needs evaluation |
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges....
1 affected package
crun
| Package | 24.04 LTS |
|---|---|
| crun | Needs evaluation |
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents...
2 affected packages
libxfont, libxfont2
| Package | 24.04 LTS |
|---|---|
| libxfont | Needs evaluation |
| libxfont2 | Not in release |
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer....
2 affected packages
libxfont, libxfont2
| Package | 24.04 LTS |
|---|---|
| libxfont | Needs evaluation |
| libxfont2 | Not in release |
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by...
1 affected package
libfreemarker-java
| Package | 24.04 LTS |
|---|---|
| libfreemarker-java | Needs evaluation |
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The...
1 affected package
cjson
| Package | 24.04 LTS |
|---|---|
| cjson | Needs evaluation |
An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
1 affected package
gpac
| Package | 24.04 LTS |
|---|---|
| gpac | Needs evaluation |