Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the SOCKS5 proxy handshake process when the hostname is longer than the target buffer and larger than 255 bytes. The local variable socks5resolvelocal could get the wrong value during a slow SOCKS5 handshak...

Heap-based Buffer Overflow

Overview curl-cffi is a python binding for curl-impersonate via cffi. Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the SOCKS5 proxy handshake process when the hostname is longer than the target buffer and larger than 255 bytes. The local variable...

CVE-2023-39533

A flaw was found in the go-libp2p package. A malicious peer can use large RSA keys to run a resource exhaustion attack and force a node to spend time doing signature verification of the large key. This issue is present in the core/crypto module of go-libp2p and can occur during the Noise handshak...

netty: SniHandler 16MB allocation leads to OOM

A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per...

Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation

Chipmaker Qualcomm has released security updates to address 17 vulnerabilities in various components, while warning that three other zero-days have come under active exploitation. Of the 17 flaws, three are rated Critical, 13 are rated High, and one is rated Medium in severity. "There are...

SUSE-SU-2023:3943-1 Security update for python311

This update for python311 fixes the following issues: Update to 3.11.5. - CVE-2023-40217: Fixed TLS handshake bypass on closed sockets bsc1214692. - CVE-2023-41105: Fixed input truncation on null bytes in os.path.normpath bsc1214693...

SUSE-SU-2023:3939-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2023-40217: Fixed TLS handshake bypass on closed sockets bsc1214692. - CVE-2023-41105: Fixed input truncation on null bytes in os.path.normpath bsc1214693...

CVE-2023-28540

Cryptographic issue in Data Modem due to improper authentication during TLS handshake...

Authentication flaw

Cryptographic issue in Data Modem due to improper authentication during TLS handshake...

CVE-2023-28540

CVE-2023-28540 affects Qualcomm Data Modem; root cause is cryptographic issue due to improper authentication during TLS handshake. Public docs (NVD/Red Hat/PRION) describe a cryptographic/authentication flaw with high impact (I=High, C=High) on data confidentiality/integrity. The Qualcomm securit...

CVE-2023-28540 Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake...

CVE-2023-28540 Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake...

Qualcomm Chip Licensing Issues Vulnerabilities

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc. and is often manufactured on the surface of semiconductor wafers. The Qualcomm chip has an authorization issue vulnerability that stems from an...

SUSE: Security Advisory (SUSE-SU-2023:3933-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Operations Dashboard is vulnerable to denial of service due to Netty

Summary Operations Dashboard is vulnerable to denial of service due to Netty CVE-2023-34462 with details below. Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS...

SUSE-SU-2023:3933-1 Security update for python

This update for python fixes the following issues: - CVE-2023-40217: Fixed TLS handshake bypass on closed sockets bsc1214692...

PT-2023-5869 · Qualcomm · Qualcomm Data Modem

Name of the Vulnerable Software and Affected Versions: Qualcomm Data Modem affected versions not specified Description: The issue is related to a cryptographic problem in the Data Modem due to improper authentication during the TLS handshake. This can allow a remote attacker to gain read, modify,...

Updated java packages fix security vulnerabilities

The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. CVE-2023-21930 Incorrect enqueue of references in garbage collector. CVE-2023-21954 Certificate validation issue in TLS session negotiation. CVE-2023-21967 Swing HTML parsing...

MGASA-2023-0272 Updated java packages fix security vulnerabilities

The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. CVE-2023-21930 Incorrect enqueue of references in garbage collector. CVE-2023-21954 Certificate validation issue in TLS session negotiation. CVE-2023-21967 Swing HTML parsing...

curl -- SOCKS5 heap buffer overflow

The curl team reports: This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255...