53 matches found
Debian DSA-4542-1 : jackson-databind - security update
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server....
[SECURITY] [DSA 4542-1] jackson-databind security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4542-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 06, 2019 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4542-1] jackson-databind security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4542-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 06, 2019 https://www.debian.org/security/faq -...
[SECURITY] [DLA 1943-1] jackson-databind security update
Package : jackson-databind Version : 2.4.2-2+deb8u9 CVE ID : CVE-2019-14540 CVE-2019-16335 CVE-2019-16942 CVE-2019-16943 Debian Bug : 940498 941530 More deserialization flaws were discovered in jackson-databind relating to the classes in com.zaxxer.hikari.HikariConfig,...
CVE-2019-16942
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the commons-dbcp 1.4 jar in the classpath, and an attacker can find a...
CVE-2019-16942
CVE-2019-16942 affects FasterXML jackson-databind 2.0.0–2.9.10. When Default Typing is enabled for an externally exposed JSON endpoint and the service includes the commons-dbcp 1.4 jar on the classpath, with an accessible RMI endpoint, the vulnerability can allow execution of a malicious payload ...
Updated libsndfile packages fix security vulnerabilities
An out of bounds read in the function d2alawarray in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values CVE-2017-14245. An out of bounds read in the function d2ulawarray in ulaw.c of libsndfil...
openSUSE Security Update : libsndfile (openSUSE-2018-140)
This update for libsndfile fixes the following issues : - CVE-2017-16942: Divide-by-zero in the function wavw64readfmtchunk, which may lead to Denial of service bsc1069874. - CVE-2017-6892: Fixed an out-of-bounds read memory access in the aiffreadchanmap bsc1043978. - CVE-2017-14634: In libsndfil...
SUSE SLES11 Security Update : Recommended update for libsndfile (SUSE-SU-2018:0351-1)
This update for libsndfile fixes a memory leak in an error path.bsc1038856 - CVE-2017-16942: A divide-by-zero error exists in the function wavw64readfmtchunk in wavw64.c, which may lead to DoS when playing a crafted audio file. bsc1069874 - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero...
SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2018:0352-1)
This update for libsndfile fixes the following issues : - CVE-2017-16942: Divide-by-zero in the function wavw64readfmtchunk, which may lead to Denial of service bsc1069874. - CVE-2017-6892: Fixed an out-of-bounds read memory access in the aiffreadchanmap bsc1043978. - CVE-2017-14634: In libsndfil...
CVE-2017-16942
In libsndfile 1.0.25 fixed in 1.0.26, a divide-by-zero error exists in the function wavw64readfmtchunk in wavw64.c, which may lead to DoS when playing a crafted audio file...
CVE-2017-16942
CVE-2017-16942 affects libsndfile up to version 1.0.25; fixed in 1.0.26. The issue is a divide-by-zero in wav_w64_read_fmt_chunk() (wav_w64.c) that may cause a DoS when opening or playing a crafted WAV/W64 file. The vulnerability is triggered during format chunk parsing and can crash the applicat...