OSV-2023-942 Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62864 Crash type: Security exception Crash state: com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop java.base/sun.nio.cs.CESU8$Encoder.encodeLoo...

PT-2023-36044 · Fasterxml +1 · Jackson-Databind +1

Name of the Vulnerable Software and Affected Versions: Spotify Docker client affected versions not specified Description: A security exception crash has been reported, involving the com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer and java.base/sun.nio.cs.CESU...

OSV-2023-920 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62731 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/sun.nio.cs.CESU8$Encoder.to3Bytes java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

SUSE-SU-2023:3862-1 Security update for salt

This update for salt fixes the following issues: Security issues fixed: - CVE-2023-20897: Fixed DOS in minion return. bsc1214796, bsc1213441 - CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. bsc1214797, bsc1193948 Bugs...

PT-2023-36039 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: A security exception crash has been reported. The crash involves the com.github.javaparser.GeneratedJavaParser.Expression and specific methods within java.base/sun.nio.cs.CESU 8$Encoder,...

The vulnerability of the neighmgrd and nlmanager components of the NVIDIA Cumulus Linux network operating system allows a hacker to trigger a service failure.

The vulnerability of the neighmgrd and nlmanager components of the NVIDIA Cumulus Linux network operating system is related to an exception handling error. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Information disclosure

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

Cloud Backup "Inner SQL exception in the service provider infrastructure"

The error documented in this article can occur due to various reasons. This article specifically addresses a single scenario related to the underlying SQL database engine used by the Veeam Cloud Service Provider. The log snippet provided in the 'Cause' section offers context to help confirm wheth...

OSV-2023-883 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62524 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2023-872 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62457 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

PT-2023-36020 · Spring · Spring

Name of the Vulnerable Software and Affected Versions: Spring versions affected versions not specified Description: The issue is related to a security exception in the org.springframework.expression.spel.ast.OpPlus.getValueInternal function. It involves the...

okio: GzipSource class improper exception handling

A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service DoS...

Node.js Module vm2 < 3.9.16 Sandbox Breakout

There exists a vulnerability in source code transformer exception sanitization logic of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor c...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to the lack of error handling in the TCP server. An attacker can cause a denial of service by initiating a significant number of connections with the server. Note: This is only exploitable if the server is running...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:3559-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3559-1 advisory. Firefox was updated to Extended Support Release 115.2.0 ESR MFSA 2023-36 bsc1214606. - CVE-2023-4574: Fixed memory corruption in IP...

CVE-2023-4578

When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Synt...

The vulnerability of the Fast DDS library, related to exception handling errors, allows attackers to trigger a service failure.

The vulnerability of the Fast DDS library is related to an exception handling error. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

SUSE: Security Advisory (SUSE-SU-2023:3559-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Java library for analyzing, extracting, and managing data in HTML documents, jsoup, is related to deficiencies in handling exceptional states, allowing attackers to trigger a service failure.

The vulnerability of the Java library for analyzing, extracting, and managing data in HTML documents, known as jsoup, is related to deficiencies in handling exceptional states. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Amazon Linux 2 : sox, --advisory ALAS2-2023-2231 (ALAS-2023-2231)

The version of sox installed on the remote host is prior to 14.4.1-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2231 advisory. A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsxreadwbuf in formatsi.c file. The...