@backland/accounts (>=0.0.0-alpha.20221203225619041, <=0.2.10), @backland/entity (>=0.0.0-alpha.20221203225619041, <=0.2.10) +111 more potentially affected by unknown CVE via fast-copy (>=3.0.0, <=3.0.2)

fast-copy NPM version =3.0.0, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221219193950991, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =6.9.5, =11.1.0, =0.0.1-evm.15,...

GHSA-JGGR-W7FW-PC2J fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

Summary fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library. Details Both copy and copyStrict recurse once per level of...

@alessiodf/crypto (3.2.2), @backland/entity (>=0.1.2-alpha.20220922T231248-0300.1, <=0.1.3-alpha.20221006T210325-0300.2) +28 more potentially affected by unknown CVE via fast-copy (>=2.0.3, <=2.1.7)

fast-copy NPM version =2.0.3, =0.1.2-alpha.20220922T231248-0300.1, =0.1.3-alpha.20221005211950.0, =0.1.2-alpha.20220922T231248-0300.1, =0.1.3-alpha.20221005211950.0, =0.1.2-alpha.20220922T231248-0300.1, =0.1.0, =0.1.0, =0.1.0, =2.0.0-alpha.20220809T004809-0300.29,...

@carefrees/table-async-validator (>=0.0.4, <=0.0.12), @fairys/pc-valtio-form-basic (>=0.0.13, <=1.0.6) +63 more potentially affected by unknown CVE via fast-copy (>=4.0.0, <=4.0.4)

fast-copy NPM version =4.0.0, =0.0.4, =0.0.13, =0.0.13, =0.0.13, =0.0.13, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-rc.9 and more Source cves: unknown CVE Source advisory:...

@carefrees/table-async-validator (>=0.0.4, <=0.0.12), @fairys/pc-valtio-form-basic (>=0.0.13, <=1.0.6) +63 more potentially affected by unknown CVE via fast-copy (>=4.0.0, <=4.0.4)

fast-copy NPM version =4.0.0, =0.0.4, =0.0.13, =0.0.13, =0.0.13, =0.0.13, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-evm.46, =0.0.1-rc.9 and more Source cves: unknown CVE Source advisory:...

@backland/accounts (>=0.0.0-alpha.20221203225619041, <=0.2.10), @backland/entity (>=0.0.0-alpha.20221203225619041, <=0.2.10) +111 more potentially affected by unknown CVE via fast-copy (>=3.0.0, <=3.0.2)

fast-copy NPM version =3.0.0, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221219193950991, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =0.0.0-alpha.20221203225619041, =6.9.5, =11.1.0, =0.0.1-evm.15,...

NPM: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

NPM: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values vulnerability discovered by ? in WordPress Npm fast-copy versions 2.2.0...

fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

Summary fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library. Details Both copy and copyStrict recurse once per level of...

@alessiodf/crypto (3.2.2), @backland/entity (>=0.1.2-alpha.20220922T231248-0300.1, <=0.1.3-alpha.20221006T210325-0300.2) +28 more potentially affected by unknown CVE via fast-copy (>=2.0.3, <=2.1.7)

fast-copy NPM version =2.0.3, =0.1.2-alpha.20220922T231248-0300.1, =0.1.3-alpha.20221005211950.0, =0.1.2-alpha.20220922T231248-0300.1, =0.1.3-alpha.20221005211950.0, =0.1.2-alpha.20220922T231248-0300.1, =0.1.0, =0.1.0, =0.1.0, =2.0.0-alpha.20220809T004809-0300.29,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fixed a memory leak in vmwmksstataddioctl. If the copy of the description string from user space fails, then the page containing the instance descriptor does not get freed before returning -EFAULT, resulting in a memo...

Astra Linux – Vulnerability in unbound

Unbound before version 1.9.5 allows assertion failures and denial of service in dnamepktcopy due to an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be remotely or locally exploited...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: NFSv4.2: fixed issues related to nfs42sscopen. A destination server, when performing a COPY operation, should not accept the passed-in filehandle if it is not a regular filehandle. If the allocfilepseudo function fails, we nee...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: binder: A check for offset alignment was added in bindergetobject. Commit 6d98eb95b450 “binder: avoid potential data leakage when copying txn” introduced changes to the way binder objects are copied. As a result, the offset...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The ATTRCTIME flags were set when setting the mtime. David reported that the new warning from setattrcopymgtime appears as follows: 113.215316 ------------ Cut here ----------- 113.215974 WARNING: CPU: 1 PID: 31 at...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Source read access is required for duplicate extents. The FSCTLDUPLICATEEXTENTSTOFILE function passes the source file directly to vfsclonefilerange or vfscopyfilerange, without checking the SMB access mask granted to the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy The string ‘s’ provided by the user space could easily have a length of zero. If this is left unchecked, it will first result in an OOB read in the form of if str0 - ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: PPC: Fixed the issue with the vcpuload leak in kvmarchvcpuioctl. The vcpuput function is not called if the user copy fails. This can lead to problems such as corruption of the preempt notifier and system crashes...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fixed the vulnerability in the migratetoram function when there is a copy error. The nouveaudmemcopyone function ensures that the copy push command is sent to the device’s firmware, but it does not track whether the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: This issue prevents a Use-after-Free UAF condition in xenvifFlushHash. During the listforeachentryrcu iteration, when calling xenvifFlushHash, kfreercu does not exist within the rcu read critical section...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Deferring the release of the inner map when necessary When updating or deleting an inner map in the map array or map htab, the map may still be accessed by non-sleepable programs or sleepable programs. However, bpfmapfdputpt...