OpenImageIO 缓冲区错误漏洞

OpenImageIO is OpenImageIO open source an image processing library . With an easy-to-use interface and a large number of supported image formats. OpenImageIO v2.4.4.2 version of a security vulnerability , the vulnerability stems from its IFFOutput alignment padding feature allows an attacker to...

CVE-2022-41802

Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernelliteosa has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked...

CVE-2022-41802

Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernelliteosa has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked...

ghostscript:gs_device_xpswrite_fuzzer: Heap-buffer-overflow in bytes_copy_rectangle_zero_padding

Detailed Report: https://oss-fuzz.com/testcase?key=5142166972530688 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicexpswritefuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 7 Crash Address: 0x7fe39a88c130 Crash State:...

kernel: dm integrity: fix memory corruption when tag_size is less than digest size

In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tagsize is less than digest size It is possible to set up dm-integrity in such a way that the "tagsize" parameter is less than the actual digest size. In this situation, a part of the dige...

Denial of Service (DoS)

Overview apple/swift-nio-http2 is a HTTP/2 support for SwiftNIO. Affected versions of this package are vulnerable to Denial of Service DoS. This can be caused by a network peer sending a specially crafted HTTP/2 frame, due to a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSHPROMISE fra...

Security Bulletin: GSKit TLS Padding Vulnerability affects IBM Tivoli/Security Server on Asset and Service Management (CVE-2014-8730)

Summary IBM Tivoli/Security Directory Server ITDS/ISDS are affected by a TLS padding vulnerability, which could allow a remote attacker to obtain sensitive information. Vulnerability Details CVE-ID : CVE-2014-8730 DESCRIPTION : IBM Security Directory Server could allow a remote attacker to obtain...

CVE-2022-35996

TensorFlow is an open source platform for machine learning. If Conv2D is given empty input and the filter and padding sizes are valid, the output is all-zeros. This causes division-by-zero floating point exceptions that can be used to trigger a denial of service attack. We have patched the issue ...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that if Conv2D is specified as an empty input and the filter and padding sizes are valid, the output is all zeros...

Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2019-1563. Vulnerability Details CVEID:CVE-2019-1563 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7dataDecode and...

Security Bulletin: TLS padding vulnerability affects IBM HTTP Server (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM HTTP Server. Vulnerability Details CVE-ID : CVE-2014-8730 DESCRIPTION : IBM HTTP Server could allow a remote attacker to obtain sensitive information,...

Ubuntu: Security Advisory (USN-361-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Grandoreiro Banking Trojan Attacks Industries in Spanish-Speaking Countries

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Grandoreiro banking trojan is a campaign that has been active since at least 2016 and targets a variety of businesses in Mexico and Spain, including automotive, chemical production, and others. Threat actors...

PT-2024-8441

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the regmap component in the Linux kernel, specifically with the spi module. The max raw read and max raw write limits in the regmap spi struct do not account for...

[SECURITY] Fedora 36 Update: golang-github-mvo5-uboot-0.4-11.fc36

Small Go package/app to read/write uboot env files that contain crc32 + 1 byte padding. Unlike fwset,printenv it does not needs a /etc/fwenv.config conf ig file...

Azure Storage SDK でのクライアントサイド暗号化におけるパディング オラクル の脆弱性を軽減

本ブログは、Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability の抄訳版です。最新の情報は原文を参照してください。...

Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability

Summary: Google informed Microsoft under Coordinated Vulnerability Disclosure CVD of a padding oracle vulnerability that may affect customers using Azure Storage SDK for Python, .NET, Java client-side encryption CVE-2022-30187. To mitigate this vulnerability, we released a new General Availabilit...

Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability

Summary Summary Google informed Microsoft under Coordinated Vulnerability Disclosure CVD of a padding oracle vulnerability that may affect customers using Azure Storage SDK for Python, .NET, Java client-side encryption CVE-2022-30187. To mitigate this vulnerability, we released a new General...

[SECURITY] Fedora 35 Update: golang-github-mvo5-uboot-0.4-10.fc35

Small Go package/app to read/write uboot env files that contain crc32 + 1 byte padding. Unlike fwset,printenv it does not needs a /etc/fwenv.config conf ig file...

kernel: dm integrity: fix memory corruption when tag_size is less than digest size

In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tagsize is less than digest size It is possible to set up dm-integrity in such a way that the "tagsize" parameter is less than the actual digest size. In this situation, a part of the dige...