UBUNTU-CVE-2024-2961

The iconv function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable...

CVE-2024-2961: Out-of-bounds Write

The iconv function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable...

CVE-2024-2961

The iconv function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable...

Security Bulletin: Vulnerabilities in medikoo es5-ext and Node.js packages might affect IBM Storage Defender – Resiliency Service (CVE-2024-27088 and CVE-2024-28849)

Summary IBM Storage Defender – Resiliency Service is vulnerable and that can result in denial of service. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-27088 DESCRIPTION: medikoo es5-ext is vulnerable to a denial of service, caused by a regular expression denial of...

DEBIAN-CVE-2024-26772

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4mbfindbygoal Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a...

CVE-2023-52622

CVE-2023-52622 concerns an ext4 online resizing failure when flexbg_size is oversized. Affected Linux kernel workflows (mkfs.ext4 -G, mount, resize2fs) could trigger WARN_ON at __alloc_pages/__kmalloc during ext4_resize_fs, caused by MAX_RESIZE_BG exceeding available memory groups. The minimum MA...

CVE-2021-47136

In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skbextadd doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TCSKBEXT originally contained only sing...

PT-2024-11186 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.0-rc7+ Description: The issue arises from the function skb ext add not initializing the created skb extension with any value, leaving it to the user. Originally, the TC SKB EXT extension contained only a...

BIT-ENVOY-2021-32777 Incorrect concatenation of multiple value request headers in ext-authz extension

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...

sqlite: heap-buffer-overflow at sessionfuzz

A vulnerability has been identified in SQLite3. This issue affects the sessionReadRecord function of the ext/session/sqlite3session.c function in the make alltest Handler component. Manipulation may cause a heap-based buffer overflow to occur...

SUSE CVE-2021-47069

In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry domqtimedreceive calls wqsleep with a stack local address. The sender domqtimedsend uses this address to later call pipelinedsend. This leads to a very hard...

SUSE CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from allowing simultaneous calls to physetmodeext to share the same PCC register...

DEBIAN-CVE-2021-47069

In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry domqtimedreceive calls wqsleep with a stack local address. The sender domqtimedsend uses this address to later call pipelinedsend. This leads to a very hard...

PT-2024-8434

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the handling of HCI EV IO CAPA REQUEST in the Linux kernel's hci event component. If HCI EV IO CAPA REQUEST is received while HCI OP READ REMOTE EXT FEATURES is y...

CVE-2021-46945

In the Linux kernel, the following vulnerability has been resolved: ext4: always panic when errors=panic is specified Before commit 014c9caa29d3 "ext4: make ext4abort use ext4error", the following series of commands would trigger a panic: 1. mount /dev/sda -o ro,errors=panic test 2. mount...

Denial Of Service (DoS)

es5-ext is vulnerable to a Denial of Service DoS. The vulnerability is due to the handling of functions with very long names or complex default argument names in functioncopy or functiontoStringTokens, which may cause the script to stall. This potentially leads to Denial of Service DoS...

GHSA-4GMJ-3P3H-GM8H es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

Impact Passing functions with very long names or complex default argument names into functioncopy orfunctiontoStringTokens may put script to stall Patches Fixed with https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 and...

es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

Impact Passing functions with very long names or complex default argument names into functioncopy orfunctiontoStringTokens may put script to stall Patches Fixed with https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 and...

@alfresco/adf-testing (6.0.0-A.2-8258), @avnet-iotc/iotc-demo (1.0.0-beta-2) +121 more potentially affected by CVE-2024-27088 via es5-ext (>=0.10.53, <=0.10.62)

es5-ext NPM version =0.10.53, =0.30.77, =0.30.77, =0.29.0, =0.29.0, =0.29.0, =0.30.46, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.30.66 and more Source cves: CVE-2024-27088 Source advisory: OSV:GHSA-4GMJ-3P3H-GM8H...