bind: stack exhaustion in control channel code may lead to DoS

A flaw was found in the Bind package. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size. Depending on the environment, this may cause the packet-parsing code...

GHSA-MJ24-GPW7-23M9 Denial of service vulnerability on creating a Launch with too many recursively nested elements in reportportal

Impact ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the testitem.path field is exceeded the allowable "ltree" field type indexing limit path length=120 approximately, recursive nesting of the nested steps...

Design/Logic Flaw

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

bind: stack exhaustion in control channel code may lead to DoS

A flaw was found in the Bind package. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size. Depending on the environment, this may cause the packet-parsing code...

Ubuntu 16.04 ESM / 18.04 ESM : Bind vulnerability (USN-6421-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6421-1 advisory. It was discovered that Bind incorrectly handled certain control channel messages. A remote attacker with access to the control channel could possibly...

bind: stack exhaustion in control channel code may lead to DoS

A flaw was found in the Bind package. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size. Depending on the environment, this may cause the packet-parsing code...

Fedora 38 : bind / bind-dyndb-ldap (2023-a2621f58a9)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-a2621f58a9 advisory. BIND 9.18.19 Security Fixes - Previously, sending a specially crafted message over the control channel could cause the packet- parsing code to run o...

CVE-2023-3341

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory,...

DEBIAN-CVE-2023-3341

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory,...

CVE-2023-3341

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory,...

CVE-2023-3341

CVE-2023-3341 describes a stack-exhaustion DoS in ISC BIND’s control channel; recursive parsing of control channel messages can overflow stack, causing named to terminate. Affected are BIND/NAMED versions across multiple series (e.g., 9.2.0–9.16.43, 9.18.0–9.18.18, 9.19.0–9.19.16, plus S1 variant...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2023-2837)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2023-2854)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Zope AccessControl Information Disclosure Vulnerability

Zope AccessControl is a generic security framework used in Zope from the Zope Foundation. An information disclosure vulnerability exists in Zope AccessControl that stems from allowing a person controlling a format string to read accessible recursive objects via attribute access and subscription o...

Ubuntu 16.04 ESM : Linux kernel (KVM) vulnerabilities (USN-6327-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6327-1 advisory. Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle locking during tableclear operations. A local...

RestrictedPython 注入漏洞

RestrictedPython is a tool that helps define a subset of the Python language that allows program input to be provided to a trusted environment. RestrictedPython suffers from an injection vulnerability that stems from the fact that Python's format function allows a person controlling a format stri...

PT-2023-5122 · Wireshark +4 · Wireshark +4

Name of the Vulnerable Software and Affected Versions: Wireshark versions 4.0.0 through 4.0.6 Description: The issue is caused by an uncontrolled recursion in the traffic analyzer, which can be exploited by a remote attacker to cause a denial of service. This can be achieved via packet injection ...

OracleVM 3.4 : kernel-uek (OVMSA-2023-0017)

The remote OracleVM system is missing necessary patches to address security updates: - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9khtcwaitfortarget function to fail with some input messages. This flaw allows a local user ...

EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2584)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105remove in...