Hardened Images
Monthly
Stack-based buffer overflow in libssh's SFTP server allows a connected client to crash the server or potentially execute code by placing files with overlong names into a directory the server subsequently lists. The flaw lives in how libssh builds the SFTP 'longname' field, concatenating attacker-influenced filenames into a fixed-size stack buffer without adequate bounds checking. There is no public exploit identified at time of analysis and EPSS is very low (0.10%), but the memory-corruption nature (CWE-121) and libssh's broad deployment make it worth prioritized patching.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.
Stack exhaustion in libdm's LVM metadata configuration parser allows any LVM command processing attacker-crafted block device metadata to crash, resulting in denial of service on affected Linux systems. The flaw is exploitable in shared storage, SAN, or virtualization environments where an adversary can supply a maliciously structured block device to a target system running LVM2. No public exploit code has been identified at time of analysis, and the vulnerability is absent from CISA KEV; however, the provided CVSS vector is materially inconsistent with the described DoS impact and warrants independent verification.
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intended command string when the %r token is expanded. Affecting libssh deployments that use ProxyCommand with %r substitution, a low-privileged local attacker who controls the username passed to the connection can cause the shell executing the ProxyCommand to expand environment variables or alter its behavior, leaking sensitive environment data. No public exploit is identified and this is not listed in CISA KEV; CVSS rates this Low (3.9), consistent with the constrained local attack surface and limited impact.
Heap-based buffer overflow in libsolv's repo_add_solv() function enables a remote unauthenticated attacker to crash the parsing process by delivering a specially crafted .solv repository metadata file containing negative values in the maxsize or allsize header fields. The malformed values bypass allocation sizing logic, producing an undersized heap buffer that is subsequently written past its bounds, yielding a denial of service. No public exploit identified at time of analysis; however, an upstream fix has been submitted via openSUSE/libsolv GitHub PR #617, and Red Hat has acknowledged the issue via a dedicated security advisory.
Stack-based buffer overflow in libsolv's Debian metadata parser allows remote, unauthenticated attackers to cause a denial of service by serving maliciously crafted Debian repository metadata containing SHA384 or SHA512 checksum tags. The root cause, confirmed by the GitHub PR #616 diff, is a statically allocated 65-byte stack buffer in `ext/repo_deb.c` sized only for SHA256 digests, which is overflowed by the larger SHA384 (96 hex chars) and SHA512 (128 hex chars) values. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; an upstream fix is available as an open pull request.
Libarchive fails to properly validate the pz_log2_bs field in ISO9660 Rock Ridge extensions during zisofs decompression, allowing remote attackers to supply a crafted ISO file that triggers undefined behavior and causes denial-of-service through incorrect memory allocation and application crashes. The vulnerability requires user interaction (ISO file opening) but no authentication, affects libarchive across multiple distributions, and carries a moderate EPSS score (0.11%, 30th percentile) suggesting low current exploitation probability despite the moderate CVSS severity.
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing delegate URI entries in XML catalogs, allowing remote attackers to trigger stack exhaustion and crash applications. This configuration-dependent denial of service requires specially crafted XML input but no authentication, affecting any application using the vulnerable library to parse untrusted catalogs. No patch is currently available.
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. [CVSS 3.7 LOW]
Stack-based buffer overflow in libssh's SFTP server allows a connected client to crash the server or potentially execute code by placing files with overlong names into a directory the server subsequently lists. The flaw lives in how libssh builds the SFTP 'longname' field, concatenating attacker-influenced filenames into a fixed-size stack buffer without adequate bounds checking. There is no public exploit identified at time of analysis and EPSS is very low (0.10%), but the memory-corruption nature (CWE-121) and libssh's broad deployment make it worth prioritized patching.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.
Stack exhaustion in libdm's LVM metadata configuration parser allows any LVM command processing attacker-crafted block device metadata to crash, resulting in denial of service on affected Linux systems. The flaw is exploitable in shared storage, SAN, or virtualization environments where an adversary can supply a maliciously structured block device to a target system running LVM2. No public exploit code has been identified at time of analysis, and the vulnerability is absent from CISA KEV; however, the provided CVSS vector is materially inconsistent with the described DoS impact and warrants independent verification.
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intended command string when the %r token is expanded. Affecting libssh deployments that use ProxyCommand with %r substitution, a low-privileged local attacker who controls the username passed to the connection can cause the shell executing the ProxyCommand to expand environment variables or alter its behavior, leaking sensitive environment data. No public exploit is identified and this is not listed in CISA KEV; CVSS rates this Low (3.9), consistent with the constrained local attack surface and limited impact.
Heap-based buffer overflow in libsolv's repo_add_solv() function enables a remote unauthenticated attacker to crash the parsing process by delivering a specially crafted .solv repository metadata file containing negative values in the maxsize or allsize header fields. The malformed values bypass allocation sizing logic, producing an undersized heap buffer that is subsequently written past its bounds, yielding a denial of service. No public exploit identified at time of analysis; however, an upstream fix has been submitted via openSUSE/libsolv GitHub PR #617, and Red Hat has acknowledged the issue via a dedicated security advisory.
Stack-based buffer overflow in libsolv's Debian metadata parser allows remote, unauthenticated attackers to cause a denial of service by serving maliciously crafted Debian repository metadata containing SHA384 or SHA512 checksum tags. The root cause, confirmed by the GitHub PR #616 diff, is a statically allocated 65-byte stack buffer in `ext/repo_deb.c` sized only for SHA256 digests, which is overflowed by the larger SHA384 (96 hex chars) and SHA512 (128 hex chars) values. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; an upstream fix is available as an open pull request.
Libarchive fails to properly validate the pz_log2_bs field in ISO9660 Rock Ridge extensions during zisofs decompression, allowing remote attackers to supply a crafted ISO file that triggers undefined behavior and causes denial-of-service through incorrect memory allocation and application crashes. The vulnerability requires user interaction (ISO file opening) but no authentication, affects libarchive across multiple distributions, and carries a moderate EPSS score (0.11%, 30th percentile) suggesting low current exploitation probability despite the moderate CVSS severity.
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing delegate URI entries in XML catalogs, allowing remote attackers to trigger stack exhaustion and crash applications. This configuration-dependent denial of service requires specially crafted XML input but no authentication, affecting any application using the vulnerable library to parse untrusted catalogs. No patch is currently available.
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. [CVSS 3.7 LOW]