CVE-2022-31052

Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the reques...

CVE-2022-31052 URL previews can crash Synapse media repositories or Synapse monoliths

Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the reques...

RLSA-2022:5314 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: stack exhaustion in doctype parsing CVE-2022-25313 expat: integer overflow in copyString CVE-2022-25314 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

expat security update

An update is available for expat. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: stack...

EulerOS 2.0 SP9 : expat (EulerOS-SA-2022-1837)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1841)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption...

Oracle Linux 8 : go-toolset:ol8addon (ELSA-2022-14857)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-14857 advisory. go-toolset 1.16.15-1 - Rebase to Go 1.16.15 golang 1.16.15-1.0.1 - Add patches from 1.16.12 to 1.16.15 - Add Sources for 3 binary files that changed...

Oracle Linux 8 : go-toolset:ol8addon (ELSA-2022-14844)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-14844 advisory. go-toolset 1.17.10-1 - Set version to correspond to the matching build golang version - delve can be now added to aarch64 as well, remove ifarch. gola...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2022-1788)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2022-1786)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2022-1803)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1803)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1786)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-1805)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-1788)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption...

Denial Of Service (DoS)

servicemesh-proxy is vulnerable to denial of service. When a cluster is deleted via Cluster Discovery Service CDS all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack...

Debian DLA-3034-1 : haproxy - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3034 advisory. - An out-of-bounds read in dnsvalidatednsresponse in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote...

EulerOS 2.0 SP3 : exiv2 (EulerOS-SA-2022-1715)

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service DOS via a crafted...

Huawei EulerOS: Security Advisory for exiv2 (EulerOS-SA-2022-1715)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GO-2021-0347 Stack exhaustion when compiling deeply nested expressions in regexp

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB...