expat: Integer overflow in storeRawNames()

An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This flaw can cause a denial of service or potentially arbitrary code execution...

expat: Integer overflow in storeRawNames()

An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This flaw can cause a denial of service or potentially arbitrary code execution...

Medium: zsh

Issue Overview: A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by a %F%K argument. This occurs because of recursive PROMPTSUBST expansion...

CVE-2022-26662

An XML Entity Expansion XEE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. A...

CVE-2022-26662

An XML Entity Expansion XEE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. A...

CVE-2022-26662

CVE-2022-26662 describes an XML Entity Expansion (XEE) vulnerability in Tryton Application Platform (Server) and Proteus, allowing an unauthenticated attacker to send crafted XML-RPC to exhaust server resources. Affected ranges include Tryton Server 5.x up through 5.0.45, 6.x up through 6.0.15, 6...

openSUSE: Security Advisory for zsh (openSUSE-SU-2022:0735-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE 15 Security Update : zsh (openSUSE-SU-2022:0735-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0735-1 advisory. - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite...

Security update for zsh (important)

openSUSE Security Update: Security update for zsh Announcement ID: openSUSE-SU-2022:0735-1 Rating: important References: 1163882 1196435 Cross-References: CVE-2019-20044 CVE-2021-45444 CVSS scores: CVE-2019-20044 NVD : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-20044 SUSE: 7...

Amazon Linux 2 : gegl (ALAS-2022-1755)

The version of gegl installed on the remote host is prior to 0.2.0-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1755 advisory. Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able...

XML Entity Expansion

xlsx-streamer is vulnerable to XML entity expansion which is also known as XML Bombs. Lack of necessary settings to prevent XML Entity Expansion issues allows an attacker to pass malicious XML object via XML parser...

Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

Impact Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues. Patches Upgrade to version 2.1.0. Workarounds No known workaround. References...

GHSA-XVM2-9XVC-HX7F Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

Impact Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues. Patches Upgrade to version 2.1.0. Workarounds No known workaround. References...

CVE-2022-23640 Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no...

PT-2022-16153 · Unknown · Xlsx-Streamer

Name of the Vulnerable Software and Affected Versions: xlsx-streamer versions prior to 2.1.0 Description: The issue concerns the XML parser used in the Excel-Streaming-Reader, which did not apply all necessary settings to prevent XML Entity Expansion issues. This problem is resolved by upgrading ...

Excel-Streaming-Reader 代码问题漏洞

Excel-Streaming-Reader is a streaming Excel reader that uses Apache POI. A code issue vulnerability exists in versions of Excel-Streaming-Reader prior to 2.1.0 that stems from the XML parser used by the software missing certain required settings, resulting in XML entity expansion issues...

Buffer Overflow

The BPF subsystem in the Linux kernel is vulnerable to buffer overflow. The vulnerability exists in kernel/bpf/core.c and kernel/bpf/core.c because of mishandling situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF...

[SECURITY] [DLA 2926-1] zsh security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2926-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort February 18, 2022 https://wiki.debian.org/LTS -...

Updated zsh packages fix security vulnerability

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPTSUBST expansion. CVE-2021-45444...

Debian: Security Advisory (DSA-5078-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...