libexpat versions before 2.8.2 contain an integer overflow vulnerability in the doProlog function related to storeEntityValue and entity textLen. This flaw could be exploited to cause a denial of service by crashing the Expat XML parser or potentially executing arbitrary code. The issue affects multiple Ubuntu package versions and has a CVSS 3.1 score of 6.9 (medium severity). Official patches are available from Ubuntu for affected releases, including long-term support versions. Users are advised to update to the fixed package versions to remediate the vulnerability.
libexpat versions before 2.8.2 contain an integer overflow vulnerability in the copyString function. This flaw can cause the library to crash, resulting in a denial of service. The issue affects multiple Ubuntu package versions across several LTS releases. A fix is available via official Ubuntu security updates.
YARD, a Ruby documentation generation tool, has a vulnerability prior to version 0.9.44 where its static cache lookup reads a request path before the router's path cleanup. This allows a traversal path to access readable sibling .html files outside the intended static directory. The issue is patched in version 0.9.44.
A vulnerability in libexpat before version 2.8.2 causes improper tracking of handler call depth when XML_ResumeParser is called from within handlers during policy violations. This flaw can lead to a use-after-free condition, potentially causing the library to crash or execute arbitrary code. The issue is similar to CVE-2026-50219. The vulnerability has a medium severity rating and a CVSS score of 4.9. Fixes are available through updated package versions provided by Ubuntu.
Coturn versions prior to 4.10.0 contain a stack buffer overflow vulnerability in the decode_oauth_token_gcm() function. The flaw arises from improper bounds checking on a nonce length field read from an attacker-supplied OAuth access token, allowing up to 735 bytes to overflow a 256-byte stack buffer. This occurs before AES-GCM authentication is verified, so an attacker does not need a valid OAuth key or token. The vulnerability requires the --oauth mode, which is not enabled by default but commonly recommended. The issue has been fixed in version 4.10.0.
A local privilege escalation vulnerability exists in the mount(8) utility of util-linux due to a time-of-check to time-of-use (TOCTOU) flaw involving target path redirection. This vulnerability allows a local attacker with limited privileges to escalate their privileges. The issue affects multiple versions of util-linux as used in various Ubuntu releases. A fix is available and has been released by Ubuntu.
A local privilege escalation vulnerability exists in util-linux's mount(8) command due to improper handling of the LIBMOUNT_FORCE_MOUNT2 environment variable, allowing bypass of nosuid and noexec mount options. This affects multiple Ubuntu util-linux package versions prior to their patched releases. The vulnerability has a CVSS 3.1 score of 7.0, indicating medium severity with high impact on confidentiality, integrity, and availability. A patch is available from Ubuntu security advisories.
An integer overflow or wraparound vulnerability exists in the libblkid component of util-linux, specifically in the src/partitions/dos.c file. This vulnerability is identified as CVE-2026-53615 and affects multiple versions of util-linux. The CVSS 3.1 base score is 8.0, indicating a high severity with local attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and high availability impact. A patch is available from the vendor to address this issue.
markdown-it versions 14.1.1 and below have a denial-of-service vulnerability triggered when the typographer option is enabled. The vulnerability arises from quadratic time complexity in the smartquotes rule due to repeated string modifications, leading to excessive CPU usage. This can allow attackers to degrade or disrupt service availability. The issue is fixed in version 14.2.0.
Tinyproxy versions through 1.11.3 have a vulnerability where conflicting Content-Length and Transfer-Encoding: chunked headers are forwarded to the backend without proper reconciliation. This allows remote attackers to desynchronize the proxy and backend parser states, enabling injection of arbitrary HTTP requests to the backend. The vulnerability can lead to cache poisoning, access control bypass, and request hijacking. The issue is fixed in a commit identified as ff45d3b.
Tinyproxy versions through 1.11.3 have a vulnerability where requests containing multiple Content-Length headers with differing values are not properly rejected. This flaw allows the proxy to forward all duplicate headers to the backend while using only the first Content-Length value to determine the request body size. Remote attackers can exploit this to desynchronize the proxy and backend parser states, enabling injection of arbitrary HTTP requests to the backend. This can lead to cache poisoning, access control bypass, and request hijacking. The issue is fixed in a commit identified as 364cdb6.
Tinyproxy versions through 1.11.3 contain a vulnerability in the validation of the Host header during stathost detection. This flaw allows unauthenticated remote attackers to access the proxy's internal statistics page by injecting a matching Host header or bypass detection via port manipulation. The vulnerability can also cause misrouting of requests as transparent proxy connections, potentially circumventing access controls. The issue was fixed in commit 09312a1.
A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8 and several other specified versions. This vulnerability allows a high privileged attacker with local access to compromise Oracle VM VirtualBox, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with integrity impact but no confidentiality or availability impact.
A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8 and multiple other specific versions. This vulnerability requires high privileges and local access to exploit and can lead to a complete takeover of the Oracle VM VirtualBox instance. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.5. Exploitation is difficult and requires a high level of access, but successful exploitation can affect additional products beyond VirtualBox due to scope change.
A vulnerability exists in the Oracle VM VirtualBox product, specifically in version 7.2.8 and several other versions. This vulnerability allows a high privileged attacker with local access to the infrastructure running Oracle VM VirtualBox to gain unauthorized read access to some data accessible by VirtualBox. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 3.2, indicating a medium severity issue.
A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8. This vulnerability allows a high privileged attacker with local access to compromise Oracle VM VirtualBox, potentially leading to unauthorized access to critical data. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 6.0, indicating a medium severity level.
A vulnerability exists in the Oracle VM VirtualBox product, specifically in version 7.2.8 and many other versions. It requires a high-privileged attacker with local access to exploit and can lead to a complete takeover of Oracle VM VirtualBox. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.5. Attacks exploiting this vulnerability may also affect additional products beyond VirtualBox. No public exploits are currently known. The vulnerability is difficult to exploit and requires high privileges and local access.
A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8. This flaw allows a high privileged attacker with local access to the infrastructure running Oracle VM VirtualBox to gain unauthorized read access to some data accessible by Oracle VM VirtualBox. The vulnerability has a medium severity with a CVSS 3.1 base score of 3.2, primarily impacting confidentiality. No known exploits are reported in the wild.
A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8 and multiple other specific versions. This flaw allows a high privileged attacker with access to the infrastructure running Oracle VM VirtualBox to cause a denial of service by hanging or crashing the software. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 6.0, indicating a medium severity level. No public exploits are known, and the vulnerability affects a broad range of VirtualBox versions.
A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8. This flaw allows a high privileged attacker with local access to the infrastructure running Oracle VM VirtualBox to gain unauthorized read access to some data accessible by Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 3.2, indicating a low confidentiality impact without affecting integrity or availability. The vulnerability may also impact other products due to scope change.