CVE-2022-24795

The CVE-2022-24795 issue affects yajl (and its ruby binding yajl-ruby). A 32-bit size_t-based integer overflow in the reallocation logic (yajl_buf.c) can cause under-allocation when handling very large inputs (~2 GB), leading to heap memory corruption and potential process availability impact. On...

CVE-2022-24795 Buffer Overflow and Integer Overflow in yajl-ruby

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

rubygem-json: Unsafe object creation vulnerability in JSON

A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem including the one bundled with Ruby can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269...

rubygem-json: Unsafe object creation vulnerability in JSON

A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem including the one bundled with Ruby can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269...

libplist:jplist_fuzzer: Heap-buffer-overflow in parse_primitive

Project: https://github.com/libimobiledevice/libplist.git Detailed Report: https://oss-fuzz.com/testcase?key=6639076466360320 Project: libplist Fuzzing Engine: libFuzzer Fuzz Target: jplistfuzzer Job Type: libfuzzerasanlibplist Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

Denial Of Service (DoS)

Play Framework is vulnerable to denial of service. The vulnerability exists in fromJson function of form.scala due to unbounded recursion during json parsing which allows an attacker to cause a stack overflow by sending a crafted json document that leads to an application crash...

Uncontrolled Recursion in Play Framework

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

Reolink RLC-410W cgiserver.cgi denial of service vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W in version v3.0.0.13620121102, which stems from the JSON parsing function of cgiserver.cgi not doing the correct handling of incoming error messages. An attacker could use th...

libplist:jplist_fuzzer: Heap-buffer-overflow in strtol

Project: https://github.com/libimobiledevice/libplist.git Detailed Report: https://oss-fuzz.com/testcase?key=5486807695884288 Project: libplist Fuzzing Engine: libFuzzer Fuzz Target: jplistfuzzer Job Type: libfuzzerasanlibplist Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

Infinite loop in Apache CFX

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

UBUNTU-CVE-2022-21653

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

Jawn 加密问题漏洞

Jawn is Typelevel open source for parsing Jay-Sawn Json. Jawn has a security vulnerability that can be exploited by attackers to perform denial-of-service attacks...

RUSTSEC-2022-0004 Stack overflow in rustc_serialize when parsing deeply nested JSON

When parsing JSON using json::Json::fromstr, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process. Example code that triggers the vulnerability is rust fn main let = rustcserialize::json::Json::fromstr&"0,".repeat10000;...

Stack overflow in rustc_serialize when parsing deeply nested JSON

When parsing JSON using json::Json::fromstr, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process. Example code that triggers the vulnerability is rust fn main let = rustcserialize::json::Json::fromstr&"0,".repeat10000;...

[SECURITY] [DSA 5023-1] modsecurity-apache security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5023-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 18, 2021 https://www.debian.org/security/faq -...

CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

gson:FuzzReader: Uncaught exception in com.google.gson.internal.bind.TypeAdapters$27.read

Project: https://github.com/google/gson.git Detailed Report: https://oss-fuzz.com/testcase?key=5297821335552000 Project: gson Fuzzing Engine: libFuzzer Fuzz Target: FuzzReader Job Type: libfuzzerasangson Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Uncaught exception in com.alibaba.fastjson.parser.DefaultJSONParser.parseObject

Detailed Report: https://oss-fuzz.com/testcase?key=4839462396362752 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Uncaught exception in com.alibaba.fastjson.parser.DefaultJSONParser.parseArray

Detailed Report: https://oss-fuzz.com/testcase?key=6522899740622848 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

libyang:lyd_parse_mem_json: Use-of-uninitialized-value in match

Project: https://github.com/CESNET/libyang.git Detailed Report: https://oss-fuzz.com/testcase?key=4869011476185088 Project: libyang Fuzzing Engine: libFuzzer Fuzz Target: lydparsememjson Job Type: libfuzzermsanlibyang Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...