895 matches found
CLSA-2024-1726841419 bind: Fix of 2 CVEs
CVE-2024-1737-1: introduced new configurable limits that prevent the loading into zones or into cache of DNS resource records RRs that exceed them - CVE-2024-1737-2: add environment variable DNSRDATASETMAXRECORDS, DNSRBTDBMAXRTYPES to override hardcoded limits DDNSRDATASETMAXRECORDS and...
OESA-2024-2121 expat security update
expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on...
CLSA-2024-1725012457 git: Fix of 2 CVEs
CVE-2024-32004: fetch/clone: detect dubious ownership of local repositories - CVE-2024-32465: upload-pack: disable lazy-fetching by default...
CLSA-2024-1724348053 bind: Fix of 2 CVEs
CVE-2024-1737: add a limit to the number of RRs in RRSets and RR types for single name - CVE-2024-1975: remove support for SIG0 message verification - Fix the SYSTEMTEST section in the spec file...
CLSA-2024-1712672592 git: Fix of 2 CVEs
CVE-2021-40330: forbid newlines in host and path in gitconnect - CVE-2022-39260: shell - limit size of interactive commands...
CLSA-2024-1710437162 bind: Fix of 2 CVEs
CVE-2023-50387: Resolved CPU exhaustion from specially crafted DNSSEC-signed zone responses - CVE-2023-50868: Resolved CPU exhaustion from DNSSEC-signed zones using NSEC3 - Enable internal tests by default...
PT-2024-21942 · Undefined · Undefined
Hey everyone, I don’t actually publicly share my findings/achievements, but wanted to make a change. So as an update I got the confirmation on my 2xCVEs. CVE-2024-27555 CVE-2024-27556 I hope to get these officially publicized soon so they are no longer "reserved" BugBounty...
PT-2024-21943 · Undefined · Undefined
Hey everyone, I don’t actually publicly share my findings/achievements, but wanted to make a change. So as an update I got the confirmation on my 2xCVEs. CVE-2024-27555 CVE-2024-27556 I hope to get these officially publicized soon so they are no longer "reserved" BugBounty...
OESA-2023-1932 squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buff...
CVE-2023-25642 Two Vulnerabilities in Some ZTE Mobile Internet Products
There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacker could use the vulnerability to perform a denial of service attack...
CLSA-2023-1700211046 squid: Fix of 2 CVEs
CVE-2023-46846: Improve HTTP chunked encoding compliance - CVE-2023-46847: Fix stack buffer overflow when parsing Digest Authorization...
CLSA-2023-1697817200 quagga: Fix of 2 CVEs
CVE-2023-41360: don't read the first byte of ORF header if we are ahead of stream - CVE-2023-41358: do not process NLRIs if the attribute length is zero...
CLSA-2023-1697816385 curl: Fix of 2 CVEs
CVE-2022-27782: check additional TLS or SSH connection parameters that should have prohibited connection reuse - CVE-2023-27534: fix SFTP path '' resolving discrepancy - fix read off end of array for SCP home directory case...
OESA-2023-1710 libXpm security update
X.Org X11 libXpm runtime library Security Fixes: A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system.CVE-2023-43788 A...
SUSE CVE-2023-39663
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk...
CLSA-2023-1692294010 amanda: Fix of 2 CVEs
CVE-2022-37705: fix tar option filtering - CVE-2023-30577: introduce tar option allow list...
CVE-2023-24582
Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...
CLSA-2023-1683814164 git: Fix of 2 CVEs
CVE-2023-25652: removing a link instead of writing into - CVE-2023-29007: restrict the config file line length to parse it whole - tests were activated - a buffer overflow during reading of configuration's enormous value has been fixed...
Vulnerabilities fixed in Oracle Hyperion
Oracle has fixed vulnerabilities in Oracle Hyperion products. The vulnerabilities allow a malicious party to cause a denial-of-service DoS or to execute arbitrary code execute arbitrary code under the application's permissions. ------------------.------.------------------------------------- | CVE...