PicoC 缓冲区错误漏洞

PicoC is a lightweight C interpreter. A buffer error vulnerability exists in PicoC version 3.2.2, which stems from a heap buffer overflow contained in the StdioBasePrintf function in cstdlib/string.c when ExpressionParseFunctionCall is called...

[SECURITY] Fedora 37 Update: python3.11-3.11.0-1.fc37

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

PYSEC-2022-43187

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

GLSA-202210-09 : Rust: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-09 Rust: Multiple Vulnerabilities - In the standard library in Rust before 1.50.0, readtoend does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow. CVE-2021-28875 - In t...

Allocation of Resources Without Limits or Throttling

Overview std/regexp/syntax is a Go standard library package std/regexp/syntax Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:Programs which compile regular expressions from untrusted sources may be vulnerable to...

DEBIAN-CVE-2022-35023

OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x8664-linux-gnu/libc.so.6+0xbb384...

uClibc 和 uClibc-ng 缓冲区错误漏洞

uClibc-ng is an application. Small C library for Linux. uClibc is a small C standard library for embedded Linux systems. A buffer error vulnerability exists in uClibc version 0.9.33.2 and uClibc-ng version 1.0.40, which stems from a thread misallocation that could lead to memory corruption...

[SECURITY] Fedora 37 Update: python3.10-3.10.7-1.fc37

Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.10 package provides the "python3.10" executable:...

Planning Go 1.20 Cryptography Work

As you might know, I left Google in spring to try and make the concept of a professional Open Source maintainer a thing. Im staying on as a maintainer of the Go cryptography standard library, and I am going to seek funding from companies that rely on it, want to ensure its security and reliabilit...

CVE-2022-35107

SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c...

Stack exhaustion on crafted paths in path/filepath

...

Uncaught Exception

Overview std/math/big is a Go standard library package std/math/big Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report:Decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

Allocation of Resources Without Limits or Throttling

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

golang: go/parser: stack exhaustion in all Parse* functions

A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability...

[SECURITY] Fedora 36 Update: golang-github-rogpeppe-internal-1.8.1-3.fc36

Selected Go-internal packages factored out from the standard library...

[SECURITY] Fedora 36 Update: golang-github-mholt-archiver-3.5.1-4.fc36

Package Archiver makes it trivially easy to make and extract common archive formats such as zip and tarball and its compressed variants. Simply name the input and output files. The arc command runs the same on all platforms and has no external dependencies not even libc. It is powered by the Go...

Information Exposure

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Information Exposure. Go Vulnerability Report: An attacker can correlate a resumed TLS session with a previous connection.Session tickets generated by crypto/tls do not...

HTTP Request Smuggling

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to HTTP Request Smuggling. Go Vulnerability Report: The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially all...

Uncontrolled Recursion

Overview std/io/fs is a Go standard library package std/io/fs Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. Remediation Upgrade...