RSS 微软安全响应中心 关注 微软网络安全和合规博客:了解微软网络安全专家的最佳实践、更新和见解。微软安全响应中心(MSRC)为保护微软用户提供了最新和有价值的安全更新和漏洞信息。通过最新的博客文章,提高您的网络安全技能,并获取保护微软产品的最好建议。 RSS blogs.technet.microsoft.com Microsoft Security Response Center msrc.microsoft.com
CVE-2023-5678 在 Q 参数值较大时,DH 检查/生成所耗费时间过长 CVE-2023-5678 Excessive time spent in DH check / generation with large Q parameter value msrc.microsoft.com
CVE-2026-34181 接受带有 PBMAC1 的 PKCS#12 文件,即使其 HMAC 密钥较短” CVE-2026-34181 PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys msrc.microsoft.com
CVE-2026-34180 ASN.1 内容解析中的堆缓冲区越读 CVE-2026-34180 Heap Buffer Over-read in ASN.1 Content Parsing msrc.microsoft.com
CVE-2026-42769 通过 CMP 根证书密钥更新中的 cert/issuer 拼写错误实现信任锚点替换 CVE-2026-42769 Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate msrc.microsoft.com
CVE-2026-42767 CRMF EncryptedValue 解密中的空指针解引用 CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption msrc.microsoft.com
CVE-2026-42766 基于密码的 CMS 解密中可能的空指针解引用” CVE-2026-42766 Possible NULL Dereference in Password-Based CMS Decryption msrc.microsoft.com
CVE-2026-42764 QUIC 服务器初始数据包处理中的空指针解引用” CVE-2026-42764 NULL Pointer Dereference in QUIC Server Initial Packet Handling msrc.microsoft.com
CVE-2026-45446 AES-GCM-SIV 和 AES-SIV 模式下空消息的错误标签处理” CVE-2026-45446 Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes msrc.microsoft.com
CVE-2026-9076 CMS 基于密码的解密中的越界读取” CVE-2026-9076 Out-of-Bounds Read in CMS Password-Based Decryption msrc.microsoft.com
CVE-2026-42768 CMS_decrypt() 和 PKCS7_decrypt() 中的多收件人信息 Bleichenbacher 预言机” CVE-2026-42768 Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() msrc.microsoft.com
CVE-2026-7383 ASN.1 多字节字符串转换中可能的堆缓冲区溢出” CVE-2026-7383 Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion msrc.microsoft.com
CVE-2026-34182 CMS AuthEnvelopedData 处理可能接受伪造消息” CVE-2026-34182 CMS AuthEnvelopedData Processing May Accept Forged Messages msrc.microsoft.com
CVE-2026-34183 QUIC PATH_CHALLENGE 处理器中的无界内存增长” CVE-2026-34183 Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler msrc.microsoft.com
CVE-2026-45447 PKCS7_verify() 函数中的堆使用后释放漏洞” CVE-2026-45447 Heap Use-After-Free in the PKCS7_verify() Function msrc.microsoft.com
CVE-2026-45445 AES-OCB IV 在EVP_Cipher()路径上被忽视 CVE-2026-45445 AES-OCB IV Ignored on EVP_Cipher() Path msrc.microsoft.com
CVE-2026-44705 tmp:通过未清理的前缀/后缀实现路径遍历,导致目录逃逸” CVE-2026-44705 tmp: Path Traversal via unsanitized prefix/postfix enables directory escape msrc.microsoft.com
CVE-2026-52858 Vim:通过 Python 全字完成实现任意代码执行” CVE-2026-52858 Vim: Arbitrary Code Execution via Python Omni-Completion msrc.microsoft.com
CVE-2026-47162 Vim:通过精心构造的目录名称,在 netrw 的 NetrwBookHistSave() 中发生 Vimscript 代码注入 CVE-2026-47162 Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name msrc.microsoft.com
CVE-2026-47167 Vim:通过精心构造的 step-definition 正则表达式在 cucumber 文件类型插件中发生的 Vimscript 代码注入” CVE-2026-47167 Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex msrc.microsoft.com
CVE-2026-52859 Vim:终端屏幕快照中的越界读取 CVE-2026-52859 Vim: Out-of-bounds Read in Terminal Screen Snapshot msrc.microsoft.com
CVE-2026-52860 Vim:通过 Python 全字完成实现任意代码执行” CVE-2026-52860 Vim: Arbitrary Code Execution via Python Omni-Completion msrc.microsoft.com
CVE-2026-46683 Snappy:通过 xsl-style-sheet 选项导致的 SSRF 和本地文件读取漏洞” CVE-2026-46683 Snappy: SSRF and local file read via the xsl-style-sheet option msrc.microsoft.com
CVE-2026-46643 Snappy:由于 is_executable 检查被反转,二进制文件路径从未进行 shell 转义” CVE-2026-46643 Snappy: Binary path is never shell-escaped due to an inverted is_executable check msrc.microsoft.com
CVE-2026-34355 Apache HTTP Server: mod_proxy_html 缓冲区溢出” CVE-2026-34355 Apache HTTP Server: mod_proxy_html buffer overflow msrc.microsoft.com
CVE-2026-44185 Apache HTTP Server:mod_ssl OCSP `send_request` 中的栈缓冲区过度读取” CVE-2026-44185 Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` msrc.microsoft.com
CVE-2026-34356 Apache HTTP Server: ProxyPassReverseCookieMap 缓冲区溢出” CVE-2026-34356 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow msrc.microsoft.com
CVE-2026-44186 Apache HTTP Server:mod_proxy_ftp 中 `proxy_ftp_handler` 的循环问题” CVE-2026-44186 Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp msrc.microsoft.com
CVE-2026-42535 Apache HTTP Server:mod_dav_fs 受保护目录访问” CVE-2026-42535 Apache HTTP Server: mod_dav_fs protected directory access msrc.microsoft.com
CVE-2026-44631 Apache HTTP Server:`ap_regname` 中的堆下溢,由有符号字符溢出导致” CVE-2026-44631 Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow msrc.microsoft.com
CVE-2026-29167 Apache HTTP Server: mod_ldap 目录级释放后使用” CVE-2026-29167 Apache HTTP Server: mod_ldap per-dir use-after-free msrc.microsoft.com
CVE-2026-43951 Apache HTTP Server:`merge_response_headers` 中的越界读取可能导致崩溃” CVE-2026-43951 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash msrc.microsoft.com
CVE-2026-42536 Apache HTTP Server: mod_xml2enc 堆溢出” CVE-2026-42536 Apache HTTP Server: mod_xml2enc heap overflow msrc.microsoft.com
CVE-2026-29170 Apache HTTP 服务器:mod_proxy_ftp XSS CVE-2026-29170 Apache HTTP Server: mod_proxy_ftp XSS msrc.microsoft.com
CVE-2026-44119 Apache HTTP Server:通过多个模块中的.htaccess 表达式导致的权限提升 CVE-2026-44119 Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules msrc.microsoft.com
CVE-2026-48913 Apache HTTP Server:mod_http2 在文件句柄耗尽时发生内存损坏” CVE-2026-48913 Apache HTTP Server: mod_http2 memory corruption when file handles exhausted msrc.microsoft.com
CVE-2026-10846 响应未充分验证是否属于查询” CVE-2026-10846 Insufficient verification that responses belong to a query msrc.microsoft.com
CVE-2026-11822 SQLite 3.53.2 之前版本 FTS5 扩展中的内存损坏问题” CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension msrc.microsoft.com
CVE-2026-11824:在 3.53.2 版本之前的 SQLite 中,通过 FTS5 的 fts5ChunkIterate 函数存在堆缓冲区溢出漏洞” CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate msrc.microsoft.com
CVE-2026-46433 lldpd:VLAN 解封装 memmove 中的堆越界读取” CVE-2026-46433 lldpd: Heap OOB Read in VLAN Decapsulation memmove msrc.microsoft.com
CVE-2026-47294 Microsoft SharePoint Server 远程代码执行漏洞” 已更新确认信息。此变更仅具信息性质。 CVE-2026-47294 Microsoft SharePoint Server Remote Code Execution Vulnerability msrc.microsoft.com
CVE-2026-46330 还原“net/smc:引入TCP ULP支持” CVE-2026-46330 Revert "net/smc: Introduce TCP ULP support" msrc.microsoft.com
CVE-2026-46325 RDMA/rxe:修复 MR 页面大小不等于 PAGE_SIZE 时的 iova 到 va 转换” CVE-2026-46325 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE msrc.microsoft.com
CVE-2026-46320 tap:在 tap_get_user_xdp() 的错误路径中释放页面” CVE-2026-46320 tap: free page on error paths in tap_get_user_xdp() msrc.microsoft.com
CVE-2026-46324 netfilter: nf_tables: 对 netlink 钩子使用 list_del_rcu CVE-2026-46324 netfilter: nf_tables: use list_del_rcu for netlink hooks msrc.microsoft.com
CVE-2026-46323 网:gro:不要合并ZCOPY SKBS CVE-2026-46323 net: gro: don't merge zcopy skbs msrc.microsoft.com
CVE-2026-46319 net/sched: act_ct: 仅在 ct_ft 之后释放 RCU 读锁” CVE-2026-46319 net/sched: act_ct: Only release RCU read lock after ct_ft msrc.microsoft.com
CVE-2026-46322 tun:在 tun_xdp_one() 中 build_skb 失败时释放页面 CVE-2026-46322 tun: free page on build_skb failure in tun_xdp_one() msrc.microsoft.com
CVE-2026-46321 tun:在 tun_xdp_one() 中因短帧拒绝而释放页面 CVE-2026-46321 tun: free page on short-frame rejection in tun_xdp_one() msrc.microsoft.com
CVE-2026-49762:Version 模块中的无界整数解析可导致 CPU 和内存耗尽拒绝服务 CVE-2026-49762 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service msrc.microsoft.com
CVE-2026-43059 Bluetooth: MGMT: 修复命令完成处理程序中的列表损坏和 UAF 问题 CVE-2026-43059 Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers msrc.microsoft.com