arrow-lifts.co.uk Cross Site Scripting vulnerability OBB-2796613

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-8CW2-JV5C-C825 Missing Initialization of Resource in Apache Arrow

It was discovered that the C++ implementation which underlies the R, Python and Ruby implementations of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow...

GHSA-CJW4-2W9R-R8MV Missing Initialization of Resource in Apache Arrow

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

Missing Initialization of Resource in Apache Arrow

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

Missing Initialization of Resource in Apache Arrow

It was discovered that the C++ implementation which underlies the R, Python and Ruby implementations of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow...

Missing Initialization of Resource in Apache Arrow

It was discovered that the C++ implementation which underlies the R, Python and Ruby implementations of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow...

Missing Initialization of Resource in Apache Arrow

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

arrow-java:FuzzIpcStream: Uncaught exception in java.base/java.nio.Bits.reserveMemory

Detailed Report: https://oss-fuzz.com/testcase?key=6541451107893248 Project: arrow-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzIpcStream Job Type: libfuzzerasanarrow-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.nio.Bits.reserveMemory...

arrowinternational.com Cross Site Scripting vulnerability OBB-2597673

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arrow-java:FuzzIpcStream: Uncaught exception in java.base/java.nio.Bits.reserveMemory

Detailed Report: https://oss-fuzz.com/testcase?key=5870434794471424 Project: arrow-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzIpcStream Job Type: libfuzzerasanarrow-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.nio.Bits.reserveMemory...

The vulnerability of the put_arrow() function in the genpict2e.c component of the Fig2dev file conversion utility allows a hacker to cause a service failure.

The vulnerability of the putarrow function in the genpict2e.c component of the Fig2dev file conversion utility is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to cause a service failure by converting an xfig file into the pict2e format...

arrow-java:FuzzIpcStream: Uncaught exception in java.base/java.nio.Bits.reserveMemory

Detailed Report: https://oss-fuzz.com/testcase?key=5411581770465280 Project: arrow-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzIpcStream Job Type: libfuzzerasanarrow-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.nio.Bits.reserveMemory...

arrow-java:FuzzIpcStream: Uncaught exception in java.base/java.nio.Bits.reserveMemory

Detailed Report: https://oss-fuzz.com/testcase?key=6270750732976128 Project: arrow-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzIpcStream Job Type: libfuzzerasanarrow-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.nio.Bits.reserveMemory...

DEBIAN-CVE-2022-23614

Twig is an open source template language for PHP. When in a sandbox mode, the arrow parameter of the sort filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of...

PT-2022-2575

Name of the Vulnerable Software and Affected Versions Twig versions prior to the patched version Description The issue arises from the lack of proper enforcement of the constraint that the arrow parameter of the sort filter must be a closure when in sandbox mode. This could lead to code injection...

arrow-java:FuzzIpcStream: Uncaught exception in java.base/java.nio.Bits.reserveMemory

Detailed Report: https://oss-fuzz.com/testcase?key=4599882936090624 Project: arrow-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzIpcStream Job Type: libfuzzerasanarrow-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.nio.Bits.reserveMemory...

Denial of Service by injecting highly recursive collections or maps in XStream

Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.19 monitors and accumulates the...

arrow-java:FuzzIpcFile: Uncaught exception in java.base/java.nio.HeapByteBuffer.<init>

Detailed Report: https://oss-fuzz.com/testcase?key=5015797066498048 Project: arrow-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzIpcFile Job Type: libfuzzerasanarrow-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.nio.HeapByteBuffer...

arrow:parquet-arrow-fuzz: Heap-buffer-overflow in parquet::DeltaByteArrayDecoder::GetInternal

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4529592296144896 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

OSV-2021-1592 Heap-buffer-overflow in arrow::internal::ValidateArrayImpl::Visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41143 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::internal::ValidateArrayImpl::Visit arrow::internal::ValidateArrayImpl::ValidateWithType arrow::internal::ValidateArrayImpl::Validate...