CVE-2022-25147

Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility APR-util 1.6.1 and prior versions...

PT-2023-9004 · Apache +10 · Apr-Util +10

Name of the Vulnerable Software and Affected Versions: Apache Portable Runtime Utility APR-util versions 1.6.1 and prior versions. Description: The issue is related to an Integer Overflow or Wraparound vulnerability in the apr base64 functions of Apache Portable Runtime Utility APR-util, allowing...

PT-2023-4908 · Libtiff +6 · Libtiff +6

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.4.0 Description: The issue is related to an out-of-bounds read in the tiffcp utility, located in tools/tiffcp.c:948, which can be exploited by attackers to cause a denial-of-service via a crafted tiff file. This can lead to ...

Important: Red Hat Security Advisory: sudo security update

An update for sudo is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

sudo security update

An update is available for sudo. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sudo packages contain the sudo utility which allows system administrators to...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU Gzip (CVE-2022-1271)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU Gzip caused by improper validation of file name by the zgrep utility CVE-2022-1271. GNU Gzip and the zgrep utility are used as part of the base image included in our service component...

RHEL 8 : libtiff (RHSA-2023:0095)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0095 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: LibTiff: DoS from...

SUSE-SU-2023:0060-1 Security update for tiff

This update for tiff fixes the following issues: - CVE-2022-3570: Fixed a potential crash in the tiffcrop utility bsc1205422. - CVE-2022-3598: Fixed a potential crash in the tiffcrop utility bsc1204642...

EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2023-1226)

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - libtiff's tiffcrop utility has a uint32t underflow that can lead to out of bounds read and write. An attacker who supplies a...

globalpom-utils 安全漏洞

globalpom-utils is the module that contains the global POM utility. A security vulnerability exists in globalpom-utils versions prior to 4.5.1, which stems from the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/ A problem with the function...

[SECURITY] Fedora 37 Update: binwalk-2.3.3-1.fc37

Binwalk is a tool for searching a given binary image for embedded files and executable code. Specifically, it is designed for identifying files and code embedded inside of firmware images. Binwalk uses the python-magic library, so it is compatible with magic signatures created for the Unix file...

CVE-2021-32821

CVE-2021-32821 affects MooTools (JavaScript utilities). The issue is a vulnerability in MooTools’ CSS selector parser, where a crafted CSS selector can trigger a Regular Expression Denial of Service (ReDoS) at runtime. Exploitation requires injecting a string into a selector (e.g., via runtime qu...

Denial Of Service

poppler is vulnerable to denial of service attacks. A logical error in the Hints::Hints function in the Hints.cc file allows an attacker to trick a user into opening a crafted PDf file into the pdftops utility, which causes the program to hang for a long time, leading to a denial of service...

PT-2022-6184 · Gnu · Gnu Core Utilities

Name of the Vulnerable Software and Affected Versions: GNU Core Utilities affected versions not specified Description: The issue is related to the distribution of resources without limits or regulation in the cp utility of the GNU Core Utilities package in the EMIAS OS operating system...

Indeed Engineering util 跨站脚本漏洞

util is a set of useful Java utilities open-sourced by Indeed Engineering. A cross-site scripting vulnerability exists in Indeed Engineering util versions prior to 1.0.33. Attackers use this vulnerability to execute cross-site scripting attacks...

OpenImageIO Project OpenImageIO IFFOutput wild write vulnerability

Talos Vulnerability Report TALOS-2022-1656 OpenImageIO Project OpenImageIO IFFOutput wild write vulnerability December 22, 2022 CVE Number CVE-2022-43601,CVE-2022-43600,CVE-2022-43599,CVE-2022-43602 SUMMARY Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of...

K08402414: BIG-IP ASM and Advanced WAF REST API endpoint vulnerability CVE-2022-23026

Security Advisory Description An authenticated user with low privileges, such as a guest, can upload data using an undisclosed REST endpoint causing an increase in disk resource utilization. CVE-2022-23026 Impact An authenticated user with low privileges, such as a guest, may exploit this...

Denial of service by double-checked locking in openssl-src

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems most widely: Windows this results in a denial of service when the affected process hangs. Policy processing being enabled o...

New TrueBot Malware Variant Leveraging Netwrix Auditor Bug and Raspberry Robin Worm

Cybersecurity researchers have reported an increase in TrueBot infections, primarily targeting Mexico, Brazil, Pakistan, and the U.S. Cisco Talos said the attackers behind the operation have moved from using malicious emails to alternative delivery methods such as the exploitation of a now-patche...

[SECURITY] Fedora 37 Update: sfnt2woff-zopfli-1.3.1-3.fc37

This is a modified version of the sfnt2woff utility that uses Zopfli as a compression algorithm instead of zlib. This results in compression gains of =EF=BF=BD=EF=BF=BD=EF=BF=BD on average =EF=BF=BD=EF=BF=BD=EF=BF=BD 5-8% compared to regular WOFF files. Z opfli generates compressed output that is...