Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:4080-1

Опубликовано: 08 сент. 2026
Источник: suse-cvrf

Описание

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issue:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
libusb-1_0-0-1.0.20-7.3.1
libusb-1_0-0-32bit-1.0.20-7.3.1
libusb-1_0-devel-1.0.20-7.3.1

Ссылки

Описание

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libusb-1_0-0-1.0.20-7.3.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libusb-1_0-0-32bit-1.0.20-7.3.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libusb-1_0-devel-1.0.20-7.3.1
Ссылки