CVE-2021-41959: Missing Release of Memory after Effective Lifetime

JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp, which causes a memory leak...

JerryScript Git security vulnerability

JerryScript is a lightweight JavaScript engine from the Jerryscript project. A security vulnerability exists in JerryScript Git version 14ff5bf, which stems from not adequately tracking and freeing allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after a RegExp...

PT-2022-11517

Name of the Vulnerable Software and Affected Versions JerryScript Git version 14ff5bf Description The issue is related to a memory leak caused by insufficient tracking and release of allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp. This occurs in JerryScript Git...

vim: use after free in utf_ptr2char

A heap use-after-free vulnerability was found in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because vim is using a buffer line after it has been freed in the old regexp engine. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering...

Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation

Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...

Updated ruby packages fix security vulnerability

Double free in Regexp compilation CVE-2022-28738. A buffer overrun was found in String-to-Float conversion CVE-2022-28739...

MGASA-2022-0143 Updated ruby packages fix security vulnerability

Double free in Regexp compilation CVE-2022-28738. A buffer overrun was found in String-to-Float conversion CVE-2022-28739...

CVE-2022-28738

A double-free vulnerability was found in Ruby. The issue occurs during Regexp compilation. This flaw allows an attacker to create a Regexp object with a crafted source string that could cause the same memory to be freed twice...

Denial Of Service (DoS)

ruby is vulnerable to denial of service. The vulnerability exists due to a Double free in Regexp compilation which allows an attacker to crash the application via malicious input...

FreeBSD : Ruby -- Double free in Regexp compilation (f22144d7-bad1-11ec-9cfe-0800270512f4)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f22144d7-bad1-11ec-9cfe-0800270512f4 advisory. - piao reports: Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted...

Slackware Linux 15.0 / current ruby Multiple Vulnerabilities (SSA:2022-103-01)

The version of ruby installed on the remote host is prior to 3.0.4 / 3.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-103-01 advisory. - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It...

Double free in Regexp compilation

A double-free vulnerability is discovered in Regexp compilation. This vulnerability has been assigned the CVE identifier CVE-2022-28738. We strongly recommend upgrading Ruby. Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same...

Ruby -- Double free in Regexp compilation

piao reports: Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a "double free" vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object...

PT-2022-2610

Name of the Vulnerable Software and Affected Versions Ruby versions 3.0.0 through 3.0.3 Ruby versions 3.1.0 through 3.1.1 Description A double free was found in the Regexp compiler. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected...

CVE-2022-1154

A heap use-after-free vulnerability was found in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because vim is using a buffer line after it has been freed in the old regexp engine. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering...

MGASA-2022-0126 Updated golang packages fix security vulnerability

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB. CVE-2022-24921...

CVE-2022-1154

Use after free in utfptr2char in GitHub repository vim/vim prior to 8.2.4646...

OESA-2022-1590 golang security update

The Go Programming Language. Security Fixes: regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.CVE-2022-24921...

CVE-2022-24921

A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...

Fix of CVE: CVE-2022-0554, CVE-2022-0729, CVE-2022-0685, CVE-2022-0572

CVE-2022-0554: fix ending up with no current buffer - CVE-2022-0572: fix crashing when repeatedly using :retab - CVE-2022-0685: fix crashing when using special multi-byte character - CVE-2022-0729: fix crashing with specific regexp pattern and string...