Amazon Linux AMI : c-ares (ALAS-2021-1545)

The version of c-ares installed on the remote host is prior to 1.17.2-1.8. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1545 advisory. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can...

DEBIAN-CVE-2021-43396

In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv use cases. NOTE: the vendor states "t...

CVE-2021-43396

In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv use cases. NOTE: the vendor states "t...

CVE-2021-43396

In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv use cases. NOTE: the vendor states "t...

PT-2021-23827 · Gnu · Glibc

Name of the Vulnerable Software and Affected Versions: GNU C Library aka glibc version 2.34 Description: Remote attackers can force iconv to emit a spurious '0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv...

libxls null pointer dereference vulnerability

libxls is a C library that can read Excel xls files. libxls version 1.6.2 contains a null pointer dereference vulnerability in the xlsgetWorkSheet function in xls.c. An attacker could exploit the vulnerability to cause a denial of service via a specially crafted XLS file...

Medium: c-ares

Issue Overview: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and...

MQTT Buffer Overflow Vulnerability

MQTT Message Queuing Telemetry Transport is a messaging protocol based on the Publish/Subscribe paradigm under the ISO standard ISO/IEC PRF 20922, which works on the TCP/IP protocol family and is designed as a publish/subscribe messaging protocol for remote devices with low hardware performance a...

Heap-based Buffer Overflow in zyantific/zydis

As discussed in the report at https://www.huntr.dev/bounties/96b0a482-7041-45b1-9327-c6a4a8f32d3a/, I am re-opening the report here for proper tracking. Description Hello, we hope you're doing well during these challenging times. Whilst testing zydis built from commit 077b185 with Clang12 + ASan ...

CVE-2021-41036

In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check remlen size in readpacket...

CVE-2021-41036

In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check remlen size in readpacket...

CVE-2021-41036

In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check remlen size in readpacket...

CVE-2021-41036

In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check remlen size in readpacket...

trgil gilcc buffer overflow vulnerability

Gilcc is a C code analysis tool. trgil gilcc suffers from a buffer overflow vulnerability that stems from an out-of-bounds array access to the software's function srcparsertransstage123, which can be exploited by attackers to cause a denial of service...

openSUSE 15 Security Update : util-linux (openSUSE-SU-2021:1440-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1440-1 advisory. - DISPUTED An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources...

Huawei EulerOS: Security Advisory for squashfs-tools (EulerOS-SA-2021-2645)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2021-2623)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

c-http has an unspecified vulnerability

C-Http is an open source, Http 1.1 WebServer written in C by Marcin Dłubakowski, a Polish individual developer. yotsuyaNight c-http v0.1.0 version has a security vulnerability stemming from a problem with the length of the url in the software's handling of the delimitedread function, which an...

CVE-2021-41036

The connected Red Hat/NVD/EUVD/etc. entries confirm CVE-2021-41036 affects the Eclipse Paho MQTT C Client. Before version 1.1, the client does not check the rem_len size in readpacket, which is the root cause described across the sources. The documents do not provide explicit mitigation steps or ...

CVE-2021-41036

In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check remlen size in readpacket...