Описание
Security update for libusb-1_0
This update for libusb-1_0 fixes the following issues:
- CVE-2026-23679: NULL pointer dereference in
parse_interface()allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664). - CVE-2026-47104: one-byte out-of-bounds read in
parse_iad_array()allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1266664
- SUSE Bug 1266667
- SUSE CVE CVE-2026-23679 page
- SUSE CVE CVE-2026-47104 page
Описание
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
Затронутые продукты
Ссылки
- CVE-2026-23679
- SUSE Bug 1266664
Описание
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-47104
- SUSE Bug 1266667