266 matches found
AZL-6759 CVE-2021-39254 affecting package ntfs-3g for versions less than 2021.8.22-1
A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfsattrrecordresize, in NTFS-3G 2021.8.22...
PT-2021-5785
Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2021.8.22 Description A heap buffer overflow can occur when specially crafted NTFS attributes are read in the function ntfs attr pread i, allowing for writing to arbitrary memory or denial of service of the applicatio...
PT-2021-5772 · Ntfs-3G +6 · Ntfs-3G +6
Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs attr record resize. This issue may allow an attacker to access...
GHSA-QW5H-7F53-XRP6 Stack overflow in `ParseAttrValue` with nested tensors
Impact The implementation of ParseAttrValue can be tricked into stack overflow due to recursion by giving in a specially crafted input. Patches We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1. The fix will be included in TensorFlow 2.5.0. We will also cherrypic...
PYSEC-2021-741
TensorFlow is an end-to-end open source platform for machine learning. The implementation of ParseAttrValuehttps://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attrvalueutil.ccL397-L453 can be tricked into stack overflow due to recursion...
XSS
Withdrawn: Duplicate of GHSA-vcjj-xf2r-mwvc. Knockout, before 3.5.0-beta, has an XSS injection point in attr name binding for browser IE7 and older...
OSV-2018-138 Heap-buffer-overflow in parse_odp_key_mask_attr
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11160 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr odpflowfromstring parsekeys...
Malicious Package
Overview attr-validator is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using attr-validat...
Malicious Package
Overview attr-searchable is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...
Linux Kernel 'xfs_attr.c' Local Denial of Service Vulnerability
Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in versions of Linux kernel prior to 4.17. A local attacker could exploit the vulnerability to cause file system corruption...
kernel: filesystem corruption due to an unchecked error condition during an xfs attribute change
In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfsattrshortformaddname in fs/xfs/libxfs/xfsattr.c...
Linux kernel OOPS null pointer reference vulnerability
Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the file s/xfs/libxfs/xfsattrleaf.c in Linux kernel version 4.17.3 and earlier. An attacker can exploit this vulnerability to cause...
DEBIAN-CVE-2017-6307
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker...
CVE-2017-2618
A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...
Linux kernel information disclosure vulnerability (CNVD-2016-04424)
The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the 'schedreadattr' function in the kernel/sched/core.c file in versions of Linux kernel 3.14-rc4 prior to 3.14-rc, which stems from a progr...
OracleVM 3.2 : sudo (OVMSA-2016-0079)
The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-277...
Drupal 8.0.x-dev Cross Site Scripting
DOM Based XSS with character on IE8 and older versions IMPORTANT: this issue has been cleared for public discussion and resolution by the Drupal Security Team based on the low evidence of vulnerable browsers still existing. Problem/Motivation filterxss does not filter out the accent grave...
DEBIAN-CVE-2013-6382
Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging the CAPSYSADMIN capability for a 1 XFSIOCATTRLISTBYHANDLE or 2 XFSIOCATTRLISTBYHANDLE32...
Design/Logic Flaw
Use-after-free vulnerability in the DOM implementation in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper tracking of which document owns an Attr object...
rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attrprotected protection mechanism and modify protected model attributes via a crafted request...