Search CVE reports
41 – 50 of 46861 results
(Enforce a recursion limit in Unmarshal to prevent stack exhaustion whe ...)
16 affected packages
golang, golang-1.6, golang-1.8, golang-1.9, golang-1.10...
| Package | 22.04 LTS |
|---|---|
| golang | Not in release |
| golang-1.6 | Not in release |
| golang-1.8 | Not in release |
| golang-1.9 | Not in release |
| golang-1.10 | Not in release |
| golang-1.13 | Needs evaluation |
| golang-1.14 | Not in release |
| golang-1.16 | Not in release |
| golang-1.17 | Needs evaluation |
| golang-1.18 | Needs evaluation |
| golang-1.20 | Needs evaluation |
| golang-1.21 | Needs evaluation |
| golang-1.22 | Needs evaluation |
| golang-1.23 | Needs evaluation |
| golang-1.24 | Needs evaluation |
| golang-1.25 | Not in release |
(Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expre ...)
1 affected package
perl
| Package | 22.04 LTS |
|---|---|
| perl | Needs evaluation |
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |
[Unknown description]
1 affected package
qemu
| Package | 22.04 LTS |
|---|---|
| qemu | Needs evaluation |
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function...
7 affected packages
postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10...
| Package | 22.04 LTS |
|---|---|
| postgresql-18 | Not in release |
| postgresql-16 | Not in release |
| postgresql-14 | Needs evaluation |
| postgresql-12 | Not in release |
| postgresql-10 | Not in release |
| postgresql-9.5 | Not in release |
| postgresql-9.3 | Not in release |