Search: 18.8.3.2

RabbitMQ versions from 4.0.0 up to but not including 4.0.24, 4.1.15, 4.2.10, and 4.3.4 contain a vulnerability in the AMQP 1.0 server_mode parser. This parser incorrectly matches textual prefixes of symbolic data, sequence, and value body descriptors without verifying encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can exploit this to submit malformed descriptors that cause strict AMQP 1.0 consumers or AMQP 0-9-1 consumers to terminate unexpectedly. The broker itself remains operational, and routing or authorization is not bypassed. The issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

A memory exhaustion vulnerability exists in RabbitMQ server versions prior to 4.0.24, 4.1.15, 4.2.10, and 4.3.4. After SASL authentication, a low-privilege client can send frames with many arrays that expand memory usage excessively, potentially triggering node-wide memory alarms and blocking message publishing.

LibreCAD libdxfrw through version LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in the dwgReader18::readFileHeader() function. This flaw is caused by calling strlen on buffers that are not NUL-terminated, allowing crafted DWG files to trigger reading of adjacent stack memory and potentially crash the application. The vulnerability has a low severity rating with a CVSS score of 3.3.

Mini-XML versions 4.0.0 through 4.0.6 have an off-by-one stack out-of-bounds write vulnerability in the mxml_strtod() function when the locale decimal point is not '.'. This occurs when XML input contains a 63-digit REAL value followed by a '.' character, causing a null byte to be written past the 64-byte stack buffer, potentially corrupting stack memory or crashing the process.

Libyal libpff versions including 20120802-5, 20180714 series, and 20231205-1 contain an integer underflow vulnerability in the function libpff_record_entry_get_multi_value(). This flaw allows attackers to craft malicious PST, OST, or PAB files with specially crafted multi-value offsets that decrease non-monotonically, triggering heap out-of-bounds reads. Exploitation can cause crashes in libpff and related tools such as pypff or pffexport, potentially exposing adjacent heap memory. The vulnerability has a CVSS 3.1 score of 6.1, indicating medium severity, with local attack vector and no privilege required but user interaction needed.

OW2 ASM versions before 9.11 contain a vulnerability in the Analyzer.analyze() method that can lead to excessive resource consumption. Crafted class files analyzed through BasicVerifier, SimpleVerifier, or SourceInterpreter can trigger unbounded memory and CPU usage, resulting in denial of service. This affects specific older versions of ASM and has a medium severity rating.

OW2 ASM versions before 9.11 have a vulnerability in the asm-commons JSRInlinerAdapter component that causes uncontrolled memory allocation when processing nested JSR/RET subroutines. This can lead to exponential memory consumption, resulting in an OutOfMemoryError that crashes the Java Virtual Machine (JVM). The vulnerability affects specific older versions of ASM and has a medium severity rating.

OW2 ASM versions before 9.11 have a vulnerability in the SignatureReader.parseType() method that allows attackers to cause uncontrolled recursion. By supplying a crafted class file with deeply nested generic type signatures, an attacker can trigger a StackOverflowError during class transformation, resulting in a denial of service condition.

OW2 ASM versions before 9.11 have a vulnerability in the asm-commons AdviceAdapter component that allows attackers to cause excessive memory allocation. By crafting class files with many forward jump targets in constructors, attackers can trigger unbounded stack copies and allocate hundreds of megabytes of memory, resulting in denial of service. The vulnerability has a low severity score and does not impact confidentiality or integrity.

OW2 ASM 3.0 versions before 9.11 have a denial of service vulnerability where attackers can supply specially crafted class files to exhaust CPU resources. This occurs during processing with ClassWriter.COMPUTE_FRAMES, causing the MethodWriter.computeAllFrames() algorithm to converge very slowly and tie up threads indefinitely.

OW2 ASM versions before 9.11 have a vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() that causes quadratic memory allocation when using COMPUTE_MAXS or COMPUTE_FRAMES. An attacker can craft a class file with thousands of overlapping exception handlers to trigger excessive memory allocation, leading to an OutOfMemoryError and JVM crash.

OW2 ASM versions before 9.11 have an uncontrolled recursion vulnerability in the ClassWriter.replaceAsmInstructions() method. This flaw allows attackers to cause a denial of service by supplying crafted class files with large methods containing many long forward jumps. The vulnerability triggers unbounded recursion in the toByteArray() method, resulting in a StackOverflowError during class transformation.

OW2 ASM versions before 9.11 have a vulnerability in the Label.addSubroutineRetSuccessors() method that allows excessive memory allocation. This occurs because the method does not enforce the single-RET-per-JSR rule, enabling crafted class files with multiple RET instructions per JSR to trigger large memory allocations (~2 GB) that crash the JVM.

CVE-2026-110658 is a heap out-of-bounds read vulnerability in sofia-sip up to version 1.13.18. It occurs in the msg_multipart_parse() function when processing multipart MIME boundaries. An unauthenticated remote attacker can send an INVITE request with a multipart Content-Type header containing a boundary string longer than the message body, causing a memory read beyond the allocated heap buffer and crashing the process. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).

p7zip versions before 26.03 contain a vulnerability in the SquashFS v4 archive handler that allows attackers to leak uninitialized heap memory. This occurs when a crafted archive manipulates the superblock's no_ids field, causing the final metadata block size to be miscomputed and bypass validation. When such an archive is listed or extracted, uninitialized heap memory is returned as user and group ID properties, potentially exposing sensitive process memory contents.

A use-after-free vulnerability was identified and resolved in the Linux kernel's platform/x86 code for x86 Android tablets. The issue arises from improper reference counting of device pointers during secondary firmware node teardown, which could lead to use-after-free during driver teardown if the device is released prematurely.

This vulnerability in the Linux kernel affects the PowerPC architecture's handling of Kernel User Access Protection (KUAP) during the transition from kernel mode to user mode. The flaw involves restoring the KUAP state too early in the exit sequence, which can lead to warnings and potential improper memory access protections. The issue has been resolved by adjusting when KUAP is restored in the exit process.

CVE-2026-98395 is a vulnerability in the Linux kernel's powerpc architecture interrupt handling code. It involves corruption of the irq_soft_mask variable during replayed interrupt exits, which causes a warning and incorrect interrupt masking state. The issue occurs because local_irq_disable() overwrites irq_soft_mask incorrectly, stripping a needed bit. The fix replaces local_irq_disable() with hard_irq_disable(), which preserves the correct mask bits and resolves the warning. This fix applies to both PPC64 and PPC32 architectures and corrects interrupt replay behavior during early boot on POWER10 pseries guests.

CVE-2026-98431 addresses a deadlock vulnerability in the Linux kernel's RDMA/uverbs subsystem caused by a circular locking dependency between mmap_lock and disassociation_lock. The issue was introduced by a commit that added disassociation_lock to protect mmap registrations but inadvertently created an ABBA deadlock scenario. The fix removes disassociation_lock and relies on the existing hw_destroy_rwsem lock to prevent deadlocks. This resolves the circular dependency and prevents potential kernel lockup conditions.

A vulnerability in the Linux kernel's RDMA/efa driver was addressed to ensure proper management of admin queues during IRQ registration. The issue involved the IRQ handler accessing queues that were not fully constructed or already destroyed, leading to potential use-after-free conditions. The fix involves initializing queues with interrupts masked, requesting IRQs before enabling interrupts, and properly resetting the device and freeing IRQs before destroying queues.