SUSE-SU-2020:1687-1 Security update for libgxps

This update for libgxps fixes the following issues: - CVE-2018-10733: Fixed a heap-based buffer over-read issue in ftfontfacehash bsc1092125...

CVE-2020-12886

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses the CoAP packet header starting from the message token. The length of the token in the received message is...

CVE-2020-12884

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions parses CoAP options that may occur multiple consecutive times in a single packet. While processing th...

Out-of-bounds

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions parses CoAP options that may occur multiple consecutive times in a single packet. While processing th...

CVE-2020-12883

Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point packetdatapptr ...

CVE-2020-12884

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions parses CoAP options that may occur multiple consecutive times in a single packet. While processing th...

CVE-2020-12884

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions parses CoAP options that may occur multiple consecutive times in a single packet. While processing th...

CVE-2020-12884

CVE-2020-12884 affects Arm Mbed OS 5.15.3 CoAP library. The CoAP parser option handling (sn_coap_parser_options_parse_multiple_options) can read past the packet boundary: packet_data_pptr is advanced by option_len without a prior out-of-bounds check, while temp_parsed_uri_query_ptr validation use...

CVE-2020-12886

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses the CoAP packet header starting from the message token. The length of the token in the received message is...

CVE-2020-12886

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses the CoAP packet header starting from the message token. The length of the token in the received message is...

CVE-2020-12886

The CVE affects Arm Mbed OS CoAP library (mbed-coap) in version 5.15.3. The root cause is in sn_coap_parser_options_parse(): the length of the token is read from the message but not validated against the input buffer before accessing the token, enabling a memory access outside the buffer (buffer ...

CVE-2019-20838

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. Mitigation Do not use more than one fixed quantifier with \R or \X with UTF disabled in PCRE or PCRE2, as these are the...

PT-2020-13316

Name of the Vulnerable Software and Affected Versions Arm Mbed OS version 5.15.3 Description A buffer over-read was discovered in the CoAP library. The CoAP parser is responsible for parsing received CoAP packets. The function sn coap parser options parse multiple options parses CoAP options that...

PT-2020-13315

Name of the Vulnerable Software and Affected Versions Arm Mbed OS version 5.15.3 Description Buffer over-reads were discovered in the CoAP library. The CoAP parser is responsible for parsing received CoAP packets. The function sn coap parser options parse parses CoAP input linearly using a while...

PT-2020-13318

Name of the Vulnerable Software and Affected Versions Arm Mbed OS version 5.15.3 Description A buffer over-read was discovered in the CoAP library. The CoAP parser is responsible for parsing received CoAP packets. The function sn coap parser options parse parses the CoAP packet header starting fr...

CVE-2020-12886: Out-of-bounds Read

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses the CoAP packet header starting from the message token. The length of the token in the received message is...

CVE-2020-12884: Out-of-bounds Read

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions parses CoAP options that may occur multiple consecutive times in a single packet. While processing th...

Open-Xchange: Buffer over read from `smtp_command_parse_parameters`

Function smtpcommandparseparameters calls uniutf8getcharn with length parameter sizetp - parser-endwhen the parameter should be sizetparser-end - p To reproduce, send as input to the smtp server 8191 spaces followed by the beginning of one unicode character printf ' %8190s\xdc' " " | nc localhost...

EulerOS 2.0 SP2 : binutils (EulerOS-SA-2020-1635)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - rememberKtype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption a...

EulerOS 2.0 SP2 : libesmtp (EulerOS-SA-2020-1627)

According to the version of the libesmtp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlmbuildtype2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based...