815 matches found
GLSA-202210-09 : Rust: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202210-09 Rust: Multiple Vulnerabilities - In the standard library in Rust before 1.50.0, readtoend does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow. CVE-2021-28875 - In t...
Allocation of Resources Without Limits or Throttling
Overview std/regexp/syntax is a Go standard library package std/regexp/syntax Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:Programs which compile regular expressions from untrusted sources may be vulnerable to...
DEBIAN-CVE-2022-35023
OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x8664-linux-gnu/libc.so.6+0xbb384...
uClibc 和 uClibc-ng 缓冲区错误漏洞
uClibc-ng is an application. Small C library for Linux. uClibc is a small C standard library for embedded Linux systems. A buffer error vulnerability exists in uClibc version 0.9.33.2 and uClibc-ng version 1.0.40, which stems from a thread misallocation that could lead to memory corruption...
[SECURITY] Fedora 37 Update: python3.10-3.10.7-1.fc37
Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.10 package provides the "python3.10" executable:...
Planning Go 1.20 Cryptography Work
As you might know, I left Google in spring to try and make the concept of a professional Open Source maintainer a thing. Im staying on as a maintainer of the Go cryptography standard library, and I am going to seek funding from companies that rely on it, want to ensure its security and reliabilit...
CVE-2022-35107
SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c...
Stack exhaustion on crafted paths in path/filepath
...
Uncaught Exception
Overview std/math/big is a Go standard library package std/math/big Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report:Decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...
Allocation of Resources Without Limits or Throttling
Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of...
golang: io/fs: stack exhaustion in Glob
A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...
golang: go/parser: stack exhaustion in all Parse* functions
A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability...
[SECURITY] Fedora 36 Update: golang-github-rogpeppe-internal-1.8.1-3.fc36
Selected Go-internal packages factored out from the standard library...
[SECURITY] Fedora 36 Update: golang-github-mholt-archiver-3.5.1-4.fc36
Package Archiver makes it trivially easy to make and extract common archive formats such as zip and tarball and its compressed variants. Simply name the input and output files. The arc command runs the same on all platforms and has no external dependencies not even libc. It is powered by the Go...
Information Exposure
Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Information Exposure. Go Vulnerability Report: An attacker can correlate a resumed TLS session with a previous connection.Session tickets generated by crypto/tls do not...
HTTP Request Smuggling
Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to HTTP Request Smuggling. Go Vulnerability Report: The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially all...
Uncontrolled Recursion
Overview std/io/fs is a Go standard library package std/io/fs Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. Remediation Upgrade...
Uncontrolled Recursion
Overview std/go/parser is a Go standard library package std/go/parser Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due ...
DEBIAN-CVE-2022-1923
DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it...