https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:48:24 +0000 https://cve.radiocsirt.org/vuln/certfr-2018-avi-216 certfr-2018-avi-216 https://cve.radiocsirt.org/vuln/certfr-2018-avi-216 https://cve.radiocsirt.org/vuln/cnvd-2018-14339 cnvd-2018-14339 https://cve.radiocsirt.org/vuln/cnvd-2018-14339 https://cve.radiocsirt.org/vuln/euvd-2026-178213 EUVD-2026-178213 https://cve.radiocsirt.org/vuln/euvd-2026-178213 https://cve.radiocsirt.org/vuln/fkie_cve-2018-5848 <p>In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the &#39;ie_len&#39; argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.</p> <p>In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the &#39;ie_len&#39; argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-5848 https://cve.radiocsirt.org/vuln/ghsa-hf9h-mjmm-hjj4 <p>In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the &#39;ie_len&#39; argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.</p> <p>In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the &#39;ie_len&#39; argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.</p> https://cve.radiocsirt.org/vuln/ghsa-hf9h-mjmm-hjj4 https://cve.radiocsirt.org/vuln/gsd-2018-5848 gsd-2018-5848 https://cve.radiocsirt.org/vuln/gsd-2018-5848 https://cve.radiocsirt.org/vuln/rhsa-2018:2948 <p>kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation kernel: Use-after-free in drivers/media/dvb-core/dvb_frontend.c kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service hw: cpu: speculative store bypass kernel: drivers/block/loop.c mishandles lo_release…</p> <p>kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation kernel: Use-after-free in drivers/media/dvb-core/dvb_frontend.c kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service hw: cpu: speculative store bypass kernel: drivers/block/loop.c mishandles lo_release…</p> https://cve.radiocsirt.org/vuln/rhsa-2018:2948 https://cve.radiocsirt.org/vuln/rhsa-2018:3083 <p>kernel: AIO write triggers integer overflow in some protocols kernel: Information leak when handling NM entries containing NUL kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation kernel: Handling of might_cancel queueing is not properly pretected against race kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service kernel: Mishandling mutex within libsas allowing local Denial of Service kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c kernel: Division by zero in change_port_settings in drivers/usb/serial/io_ti.c resulting in a denial of service kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) kernel…</p> <p>kernel: AIO write triggers integer overflow in some protocols kernel: Information leak when handling NM entries containing NUL kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation kernel: Handling of might_cancel queueing is not properly pretected against race kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service kernel: Mishandling mutex within libsas allowing local Denial of Service kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c kernel: Division by zero in change_port_settings in drivers/usb/serial/io_ti.c resulting in a denial of service kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) kernel…</p> https://cve.radiocsirt.org/vuln/rhsa-2018:3083 https://cve.radiocsirt.org/vuln/suse-su-2018:1761-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2018:1761-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-5848 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: linux-aws, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-aws-hwe, Ubuntu:16.04:LTS: linux-azure, Ubuntu:16.04:LTS: linux-gcp, Ubuntu:16.04:LTS: linux-hwe and 32 more</p> <p>In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the &#39;ie_len&#39; argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: linux-aws, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-aws-hwe, Ubuntu:16.04:LTS: linux-azure, Ubuntu:16.04:LTS: linux-gcp, Ubuntu:16.04:LTS: linux-hwe and 32 more</p> <p>In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the &#39;ie_len&#39; argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-5848