CVE-2022-22040

Technical details about CVE-2022-22040 are not publicly provided in the supplied documents. Monitor for updates from official sources for affected products, impact specifics, and fixes before taking action.

Internet Information Services Dynamic Compression Module Denial of Service Vulnerability

...

CVE-2022-22040: Undefined Security Weakness

Internet Information Services Dynamic Compression Module Denial of Service Vulnerability...

PT-2022-4638

Name of the Vulnerable Software and Affected Versions compress/gzip versions prior to 1.17.12 compress/gzip versions prior to 1.18.4 Description The issue is related to uncontrolled recursion in the Reader.Read function of the compress/gzip package in the Go programming language. This can be...

KLA12581 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, obtain sensitive information, execute arbitrary code, cause denial of service. Below is a complete list of...

CLSA-2022-1657561632 Fixed CVEs in openssh-5.3p1: CVE-2016-10708, CVE-2016-10012

CVE-2016-10708: fix crash in packet handling code by moving inbound NEWKEYS handling to kex layer - CVE-2016-10012: abandon the fix due to compression mode issues...

Fixed CVEs in openssh-5.3p1: CVE-2016-10708, CVE-2016-10012

CVE-2016-10708: fix crash in packet handling code by moving inbound NEWKEYS handling to kex layer - CVE-2016-10012: abandon the fix due to compression mode issues...

CLSA-2022-1657560108 Fixed CVEs in openssh: CVE-2016-10708, CVE-2016-10012

CVE-2016-10708: fix crash in packet handling code by moving inbound NEWKEYS handling to kex layer - CVE-2016-10012: abandon the fix due to compression mode issues...

OSV-2022-571 Use-of-uninitialized-value in LZ4_compress_fast_extState_fastReset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48993 Crash type: Use-of-uninitialized-value Crash state: LZ4compressfastextStatefastReset LZ4FcompressBlock LZ4FcompressUpdateImpl...

lz4:round_trip_frame_uncompressed_fuzzer: Use-of-uninitialized-value in LZ4_compress_fast_extState_fastReset

Project: https://github.com/lz4/lz4.git Detailed Report: https://oss-fuzz.com/testcase?key=5810591549227008 Project: lz4 Fuzzing Engine: libFuzzer Fuzz Target: roundtripframeuncompressedfuzzer Job Type: libfuzzermsanlz4 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

lz4:round_trip_frame_uncompressed_fuzzer: Use-of-uninitialized-value in LZ4HC_compress_generic_noDictCtx

Project: https://github.com/lz4/lz4.git Detailed Report: https://oss-fuzz.com/testcase?key=6235198659887104 Project: lz4 Fuzzing Engine: libFuzzer Fuzz Target: roundtripframeuncompressedfuzzer Job Type: libfuzzermsanlz4 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

EulerOS 2.0 SP9 : zstd (EulerOS-SA-2022-2017)

According to the versions of the zstd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if ...

Huawei EulerOS: Security Advisory for zstd (EulerOS-SA-2022-1987)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ALPINE-CVE-2022-32206

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

CVE-2022-32206

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

DEBIAN-CVE-2022-32206

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

Design/Logic Flaw

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

SUSE-SU-2022:2327-2 Security update for curl

This update for curl fixes the following issues: - CVE-2022-32206: HTTP compression denial of service bsc1200735 - CVE-2022-32208: FTP-KRB bad message verification bsc1200737...

CVE-2022-32206

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

openSUSE: Security Advisory for curl (SUSE-SU-2022:2305-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...