Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9215)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9215 advisory. - btrfs: fix race when cloning extent buffer during rewind of an old root Filipe Manana Orabug: 32669454 CVE-2021-28964 - xen-blkback: don't leak...

OPENSUSE-SU-2021:0670-1 Security update for openexr

This update for openexr fixes the following issues: - CVE-2021-23215: Fixed an integer-overflow in Imf25:DwaCompressor:initializeBuffers bsc1185216. - CVE-2021-26260: Fixed an Integer-overflow in Imf25:DwaCompressor:initializeBuffers bsc1185217. - CVE-2021-20296: Fixed a Null Pointer dereference ...

CVE-2020-36332

A flaw was found in libwebp. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability...

IoT riddled with BadAlloc vulnerabilities

The Cybersecurity and Infrastructure Security Agency CISA has published advisory ICSA-21-119-04 about vulnerabilities found in multiple real-time operating systems RTOS and supporting libraries. Those operating systems and libraries are widely used in smart, Internet-connected "things". The numbe...

Microsoft Warns of 25 Critical Vulnerabilities in IoT, Industrial Devices

Security researchers at Microsoft are warning the industry about 25 as-yet undocumented critical memory-allocation vulnerabilities across a number of vendors’ IoT and industrial devices that threat actors could exploit to execute malicious code across a network or cause an entire system to crash...

Microsoft Finds 'BadAlloc' Flaws Affecting Wide-Range of IoT and OT Devices

Microsoft researchers on Thursday disclosed two dozen vulnerabilities affecting a wide range of Internet of Things IoT and Operational Technology OT devices used in industrial, medical, and enterprise networks that could be abused by adversaries to execute arbitrary code and even cause critical...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2021-1808)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

EulerOS 2.0 SP3 : soundtouch (EulerOS-SA-2021-1849)

According to the versions of the soundtouch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock...

eCosCentric eCosPro Input Validation Error Vulnerability

eCosCentric eCosPro is a software application from eCosCentric, Inc. It combines the feature set, stability and quality of support required for commercial embedded application development with eCos. eCosCentric eCosPro Versions suffers from an Input Validation Error vulnerability that stems from ...

EulerOS 2.0 SP3 : libplist (EulerOS-SA-2021-1812)

According to the versions of the libplist package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process...

klibc 输入验证错误漏洞

klibc is an application program. Provides the ability to work with as many early starts from kernel space as possible. klibc versions prior to 2.0.9 are vulnerable to an input validation error that stems from an addition in the malloc function that could lead to an integer overflow and subsequent...

NXP MCUXpresso Software Development Kit Input Validation Error Vulnerability

The NXP MCUXpresso Software Development Kit is an application system from the Dutch company NXP. It is used to simplify and accelerate the development of applications with ARM's Cortex NXP-M based devices, including general purpose, crossover and Bluetooth microcontrollers. An input validation...

uClibc-ng Input Validation Error Vulnerability

uclibc-ng is an application. Small C library for Linux. An input validation error vulnerability exists in versions prior to uClibc-ng 1.0.37, which stems from being susceptible to integer wrapping by the malloc-simple function. This incorrect memory allocation could lead to arbitrary memory...

OPENSUSE-SU-2021:0628-1 Security update for nim

This update for nim fixes the following issues: num was updated to version 1.2.12: Fixed GC crash resulting from inlining of the memory allocation procs Fixed “incorrect raises effect for $NimNode” 17454 From version 1.2.10: Fixed “JS backend doesn’t handle float-int type conversion “ 8404 Fixed...

Buffer Overflow

podofo is vulnerable to buffer overflow. The vulnerability exists due to a an attempted excessive memory allocation in PoDoFo::podofocalloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp...

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

Microsoft’s Section 52, the Azure Defender for IoT security research group, recently uncovered a series of critical memory allocation vulnerabilities in IoT and OT devices that adversaries could exploit to bypass security controls in order to execute malicious code or cause a system crash. These...

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

Microsoft’s Section 52, the Azure Defender for IoT security research group, recently uncovered a series of critical memory allocation vulnerabilities in IoT and OT devices that adversaries could exploit to bypass security controls in order to execute malicious code or cause a system crash. These...

Tencent OS-tiny 输入验证错误漏洞

Tencent OS-tiny is a real-time operating system developed by Tencent for the Internet of Things IoT. It is characterized by low power consumption, low resource consumption, modularity, security and reliability, which can effectively improve the development efficiency of IoT terminal products. An...

PT-2021-4215 · Texas Instruments · Ti-Rtos

Name of the Vulnerable Software and Affected Versions: Texas Instruments TI-RTOS affected versions not specified Description: The issue is related to an integer overflow vulnerability in the HeapMem allocUnprotected function. This vulnerability can be triggered when the malloc function returns a...

uC-OS2 输入验证错误漏洞

uC-OS2 is an operating system. portable, ROM-able, scalable, preemptive real-time deterministic multitasking kernel for microprocessors, microcontrollers and DSPs. An input validation error vulnerability exists in the uC-OS2 version and prior versions, which stems from the fact that unvalidated...