| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Buffer over-read in Windows COM+ Event System Service allows an authorized attacker to disclose information locally. |
| Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
| Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
| Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network. |
| Buffer over-read in Windows Shell allows an authorized attacker to disclose information locally. |
| Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
| Buffer over-read in Microsoft Windows SCSI Class System File allows an authorized attacker to disclose information locally. |
| Buffer over-read in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network. |
| Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally. |
| In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix fiemap wild read on empty truncated response
smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob
and loops for the next chunk. If the server reports
STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns
-E2BIG with out_data == NULL and out_data_len == 0, and the existing
length checks accept the empty result. The loop then evaluates
next = out_data[num - 1].file_offset + ...
with num == 0, reading 16 bytes before NULL.
Reject a truncated range blob that contains no range, so the resume
offset is never computed from an empty response. Also require the last
range in a truncated blob to advance the resume offset without
overflowing, and to stay within the requested range; a malicious or
broken server could otherwise make no progress or underflow len and loop
forever. Free the previous response buffer before retrying.
Reproduced on 6.6.87.2 with a malicious SMB2 server that answers
FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and
OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in
cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged
on mainline. |
| Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network. |
| Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally. |
| libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications. |
| A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server. |
| A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program. |
| A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. |
| A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure. |
