Design/Logic Flaw

An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxmlparse functions mishandle XML entities, leading to an infinite loop in which memory allocations occur...

CVE-2019-20201

An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxmlparse functions mishandle XML entities, leading to an infinite loop in which memory allocations occur...

CVE-2019-20201

An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxmlparse functions mishandle XML entities, leading to an infinite loop in which memory allocations occur...

HTTP/2: 0-length headers lead to denial of service

A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...

HTTP/2: 0-length headers lead to denial of service

A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...

CVE-2019-9012

An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.2...

PT-2019-19309 · 3S Smart · Codesys V3

Name of the Vulnerable Software and Affected Versions: 3S-Smart CODESYS V3 products versions prior to 3.5.14.20 Description: A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products, potentially resulting in a denial-of-service condition. The issu...

FreeBSD : bro -- NULL pointer dereference and Signed integer overflow (f56669f5-d799-4ff5-9174-64a6d571c451)

Jon Siwek of Corelight reports : This is a security patch release to address potential Denial of Service vulnerabilities : - NULL pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. - Signed integer overflow in BinPAC-generat...

Input validation

improper input validation in allocation request for secure allocations can lead to page fault. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and...

CVE-2019-2330

CVE-2019-2330 describes an issue with improper input validation in the allocation request for secure allocations, which can lead to a page fault on Qualcomm hardware. Affected products span multiple Qualcomm platforms (e.g., Snapdragon Auto/Compute/Mobile/IoT, IPQ4019/IPQ8064/IPQ8074, MDM9xxx, SD...

Denial Of Service (DoS)

Eclipse Jetty is vulnerable to denial of service attacks. A remote, unauthenticated attacker could exploit the flawed SETTING Frame Handler component due to the additional CPU and memory allocations required to handle setting changes causing denial of service conditions...

Kernel update: Virtuozzo ReadyKernel patch 77.1 for Virtuozzo 7.0.7

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to Virtuozzo kernels 3.10.0-693.17.1.vz7.43.10 Virtuozzo 7.0.7. Vulnerability id: PSBM-93349 ploop: potential data corruption due to a race between 'preparemerge' and 'submitalloc' operations...

Kernel update: Virtuozzo ReadyKernel patch 77.0 for Virtuozzo 7.0.6 and 7.0.6 HF3

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to Virtuozzo kernels 3.10.0-693.1.1.vz7.37.30 Virtuozzo 7.0.6 and 3.10.0-693.11.6.vz7.40.4 Virtuozzo 7.0.6 HF3. Vulnerability id: PSBM-93349 ploop: potential data corruption due to a race between...

[SECURITY] Fedora 30 Update: libxmlb-0.1.8-2.fc30

XML is slow to parse and strings inside the document cannot be memory mappe d as they do not have a trailing NUL char. The libxmlb library takes XML source, and converts it to a structured binary representation with a deduplicated string table -- where the strings have the NULs included. This...

Code injection

TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 636, SD 712 / SD 710 / ...

CVE-2018-11970

TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 636, SD 712 / SD 710 / ...

GHSA-H2F4-V4C4-6WX4 Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations require...

CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations require...

Fedora 29 : libssh2 (2019-f31c14682f)

This update addresses various overflow conditions that could result in possible memory read/write out of bounds errors or zero byte allocations when connected to a malicious server. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Denial Of Service (DoS)

Guava is vulnerable to denial of service DoS. The attacks are possible because AtomicDoubleArray and CompoundOrdering classes perform memory allocations without checking user provided data and its size...