Total vulnerabilities in the database
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.
| Software | From | Fixed in |
|---|---|---|
| selinux_project / selinux | 3.2 | 3.2.x |
| fedoraproject / fedora | 35 | 35.x |