[SECURITY] Fedora 35 Update: golang-github-mholt-archiver-3.5.1-3.fc35

Package Archiver makes it trivially easy to make and extract common archive formats such as zip and tarball and its compressed variants. Simply name the input and output files. The arc command runs the same on all platforms and has no external dependencies not even libc. It is powered by the Go...

Medium: rust

Issue Overview: In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed or the program to crash if the borrowed string changes after its length is checked. CVE-2020-36323 In the standard library in Rust before...

Important: golang

Issue Overview: A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments. The highest threat from this vulnerability is to integrit...

[SECURITY] Fedora 36 Update: golang-github-rogpeppe-internal-1.8.1-2.fc36

Selected Go-internal packages factored out from the standard library...

[SECURITY] Fedora 36 Update: golang-github-mholt-archiver-3.5.1-3.fc36

Package Archiver makes it trivially easy to make and extract common archive formats such as zip and tarball and its compressed variants. Simply name the input and output files. The arc command runs the same on all platforms and has no external dependencies not even libc. It is powered by the Go...

Infinite loop

Overview std/encoding/binary is a Go standard library package std/encoding/binary Affected versions of this package are vulnerable to Infinite loop. Go Vulnerability Report: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs.Certain invalid inputs to ReadUvarint ...

Uncontrolled Search Path Element

Overview std/syscall is a Go standard library package std/syscall Affected versions of this package are vulnerable to Uncontrolled Search Path Element. Go Vulnerability Report: via the LoadLibrary process. An attacker can execute arbitrary code by placing a malicious DLL in a location where it wi...

Allocation of Resources Without Limits or Throttling

Overview std/crypto/dsa is a Go standard library package std/crypto/dsa Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: via the Verify function. An attacker can cause excessive resource consumption and make affecte...

CodeLineCounter:lineCounterPlugin (>=1.1.1 <=1.1.4), ae.teletronics.nlp:categorisation (>=1.3 <=1.6) +18273 more potentially affected by CVE-2020-29582 via org.jetbrains.kotlin:kotlin-stdlib (>=0.0.2-test-deploy <=1.4.21-2)

org.jetbrains.kotlin:kotlin-stdlib MAVEN version =0.0.2-test-deploy, =1.1.1, =1.3, =1.3, =1.0.1, =0.0.1, =1.2, =1.2, =1.2.3, =1.2.3, =v0.0.1, =0.1.12, =0.1.2, =0.0.12, =0.0.12, =1.0.0, =1.0.1 and more Source cves: CVE-2020-29582 Source advisory: OSV:GHSA-CQJ8-47CH-RVVQ...

GHSA-C79C-GWPH-GQFM `net2` invalidly assumes the memory layout of std::net::SocketAddr

The net2 crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the...

`net2` invalidly assumes the memory layout of std::net::SocketAddr

The net2 crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the...

Uncaught Exception

Overview std/archive/zip is a Go standard library package std/archive/zip Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: via the NewReader or OpenReader functions when processing an archive that specifies an unusually large number of files. An...

Apache Flex BlazeDS unsafe deserialization

Previous versions of Apache Flex BlazeDS 4.7.2 and earlier did not restrict which types were allowed for AMFX object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such...

golang: debug/macho: invalid dynamic symbol table command can cause panic

An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/macho standard library stdlib and malformed binaries are parsed using Open or OpenFat, it can cause golang to attempt to read outside of a slice array causing a panic when calling...

golang: archive/zip: Reader.Open panics on empty string

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where Reader.Open the API implementing io/fs.FS introduced in Go 1.16 can panic when parsing a crafted ZIP archive containing completely invalid names or an empty filename argument...

golang: net/http: limit growth of header canonicalization cache

There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of...

The vulnerability of the fread function (ext/standard/file.c) in the PHP programming language allows a hacker to cause a service failure or potentially have other adverse effects.

The vulnerability of the fread function ext/standard/file.c in the PHP programming language interpreter is caused by a numerical overflow. Exploiting this vulnerability could allow an attacker to cause service failures or potentially other adverse effects...

The vulnerability of the ext/standard/var.c component of the PHP interpreter allows a attacker to cause a service failure.

The vulnerability of the ext/standard/var.c component of the PHP interpreter is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

golang: archive/zip: Reader.Open panics on empty string

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where Reader.Open the API implementing io/fs.FS introduced in Go 1.16 can panic when parsing a crafted ZIP archive containing completely invalid names or an empty filename argument...

CodeLineCounter:lineCounterPlugin (>=1.1.1 <=1.1.4), ae.teletronics.nlp:categorisation (>=1.3 <=1.6) +27611 more potentially affected by CVE-2022-24329 via org.jetbrains.kotlin:kotlin-stdlib (>=0.0.2-test-deploy <=1.6.0-RC2)

org.jetbrains.kotlin:kotlin-stdlib MAVEN version =0.0.2-test-deploy, =1.1.1, =1.3, =1.3, =1.0.1, =0.0.1, =1.2, =1.2, =1.2.3, =1.2.3, =v0.0.1, =0.1.12, =0.1.2, =0.0.12, =0.0.12, =1.0.0, =1.0.1 and more Source cves: CVE-2022-24329 Source advisory: OSV:GHSA-2QP4-G3Q3-F92W...