https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:18:18 +0000 https://vulnerability.circl.lu/vuln/cve-2025-71197 <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>w1: therm: Fix off-by-one buffer overflow in alarms_store</p> <p>The sysfs buffer passed to alarms_store() is allocated with &#39;size + 1&#39; bytes and a NUL terminator is appended. However, the &#39;size&#39; argument does not account for this extra byte. The original code then allocated &#39;size&#39; bytes and used strcpy() to copy &#39;buf&#39;, which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index &#39;size&#39;.</p> <p>Fix this by parsing the &#39;buf&#39; parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.</p> <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>w1: therm: Fix off-by-one buffer overflow in alarms_store</p> <p>The sysfs buffer passed to alarms_store() is allocated with &#39;size + 1&#39; bytes and a NUL terminator is appended. However, the &#39;size&#39; argument does not account for this extra byte. The original code then allocated &#39;size&#39; bytes and used strcpy() to copy &#39;buf&#39;, which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index &#39;size&#39;.</p> <p>Fix this by parsing the &#39;buf&#39; parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.</p> https://vulnerability.circl.lu/vuln/cve-2025-71197