Search CVE reports
401 – 410 of 27411 results
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release...
1 affected package
vifm
| Package | 26.04 LTS |
|---|---|
| vifm | Needs evaluation |
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
[openpgp: Don't imply missing key flags from key type]
1 affected package
rust-sequoia-openpgp
| Package | 26.04 LTS |
|---|---|
| rust-sequoia-openpgp | Needs evaluation |
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking...
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress....
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that...
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted...
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |