Python DoS Vulnerability (bpo-44394) - Mac OS X

Python is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

Python DoS Vulnerability (bpo-44394) - Windows

Python is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

CLSA-2022-1641903536 Fix of 8 CVEs

CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities - CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd' - CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv - CVE-2021-3541.patch: parser fix for the billion laughs attack -...

CLSA-2021-1640700669 Fixed 8 CVEs in libxml2

CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities - CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd' - CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv - CVE-2021-3541.patch: parser fix for the billion laughs attack -...

Fix of CVE: CVE-2021-3516, CVE-2021-3537, CVE-2017-8872, CVE-2021-3518, CVE-2019-20388, CVE-2020-24977, CVE-2021-3541, CVE-2021-3517

CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities - CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd' - CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv - CVE-2021-3541.patch: parser fix for the billion laughs attack -...

Brazilian marketplace integrator Hariexpress exposed 1.75 billion records

By Waqas At the time of publishing this article, the data was still exposed and growing as there has been no response from Hariexpress. This is a post from HackRead.com Read the original post: Brazilian marketplace integrator Hariexpress exposed 1.75 billion records...

CVE-2021-40439

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are...

CVE-2021-40439

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are...

CVE-2021-40439

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are...

Code injection

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are...

CVE-2021-40439 Billion Laughs

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are...

Facebook shoots own foot, hits Instagram and WhatsApp too

Mark Zuckerberg was left counting the personal cost of bad PR yesterday about $6 billion, according to Bloomberg on a day when his company couldnt get out of the news headlines, for all the wrong reasons. The billionaire Facebook CEOs bad day at the office started with whistleblower Frances Hauge...

Urgent Chrome security update released to patch widely exploited 0-day

By Deeba Ahmed The vulnerability impacts 2 Billion Chrome users worldwide therefore Google is asking users to update their browsers right now. This is a post from HackRead.com Read the original post: Urgent Chrome security update released to patch widely exploited 0-day...

Python -- multiple vulnerabilities

Python reports: bpo-44394: Update the vendored copy of libexpat to 2.4.1 from 2.2.8 to get the fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used on Windows and macOS. bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n...

snakeyaml: Billion laughs attack via alias feature

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

snakeyaml: Billion laughs attack via alias feature

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

DreamHost hosting firm exposed almost a billion sensitive records

By Habiba Rashid The database belonged to DreamHost's DreamPress managed WordPress hosting that was left exposed without any security authentication. This is a post from HackRead.com Read the original post: DreamHost hosting firm exposed almost a billion sensitive records...

GHSA-9GWX-9CWP-5C2M Billion laughs attack (XML bomb)

Impact Opencast is vulnerable to the Billion laughs attack which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast using a single HTTP request. Consider an XML file createMediaPackage.xml like this: xml mediapackage...

Billion laughs attack (XML bomb)

Impact Opencast is vulnerable to the Billion laughs attack which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast using a single HTTP request. Consider an XML file createMediaPackage.xml like this: xml mediapackage...

Opencast < 9.6 DoS Vulnerability

Opencast is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...