Most recent entries from all

bdu:2025-10907

BELL-CVE-2025-3360

Affected: Alpaquita:23: glib, Alpaquita:stream: glib

certfr-2025-avi-0939 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0939

EUVD-2026-331385

fkie_cve-2025-3360

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.

GHSA-3435-f6h9-64p7

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.

ICSA-23-348-10 — Siemens SIMATIC S7-1500

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

msrc_CVE-2025-3360 — Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid i…

msrc_CVE-2025-3360

OESA-2025-1525 — glib2 security update

Affected: openEuler:22.03-LTS-SP4: glib2, openEuler:24.03-LTS: glib2, openEuler:24.03-LTS-SP1: glib2, openEuler:20.03-LTS-SP4: glib2, openEuler:22.03-LTS-SP3: glib2

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib&apos;s code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fix(es):

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.(CVE-2025-3360)

openSUSE-SU-2025:15007-1 — gio-branding-upstream-2.84.1-2.1 on GA media

gio-branding-upstream-2.84.1-2.1 on GA media

SSA-089022 — SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…

SUSE-SU-2025:01599-1 — Security update for glib2

Security update for glib2

UBUNTU-CVE-2025-3360

Affected: Ubuntu:Pro:18.04:LTS: glib2.0, Ubuntu:Pro:20.04:LTS: glib2.0, Ubuntu:22.04:LTS: glib2.0, Ubuntu:24.04:LTS: glib2.0

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.

WID-SEC-W-2025-0712 — GNU libc: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GNU libc und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.