https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:20:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362004 EUVD-2026-362004 https://cve.radiocsirt.org/vuln/euvd-2026-362004 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68744 <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.</p> <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68744 https://cve.radiocsirt.org/vuln/ghsa-xxfg-88q3-gxgm <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.</p> <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.</p> https://cve.radiocsirt.org/vuln/ghsa-xxfg-88q3-gxgm https://cve.radiocsirt.org/vuln/oesa-2026-3645 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: sssd</p> <p>Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA. Security Fix(es):</p> <p>A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.(CVE-2026-68742)</p> <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.(CVE-2026-68744)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: sssd</p> <p>Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA. Security Fix(es):</p> <p>A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.(CVE-2026-68742)</p> <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.(CVE-2026-68744)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3645 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21748-1 <p>Security update for sssd</p> <p>Security update for sssd</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21748-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23251-1 <p>Security update for sssd</p> <p>Security update for sssd</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23251-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68744 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: sssd, Ubuntu:Pro:18.04:LTS: sssd, Ubuntu:Pro:20.04:LTS: sssd, Ubuntu:22.04:LTS: sssd, Ubuntu:24.04:LTS: sssd, Ubuntu:26.04:LTS: sssd</p> <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: sssd, Ubuntu:Pro:18.04:LTS: sssd, Ubuntu:Pro:20.04:LTS: sssd, Ubuntu:22.04:LTS: sssd, Ubuntu:24.04:LTS: sssd, Ubuntu:26.04:LTS: sssd</p> <p>A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68744