CVE-2022-28220 STARTTLS command injection in Apache JAMES

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests...

CVE-2022-28220

CVE-2022-28220 affects Apache James prior to release 3.6.3 and 3.7.1. The issue is a vulnerability in STARTTLS handling that enables a buffering attack. The root cause is related to a parser differential from CVE-2021-38542 and does not account for concurrent requests. The CVSS base score is 7.5 ...

Apache James 命令注入漏洞

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server from the Apache Foundation written entirely in Java. A command injection vulnerability exists in Apache James versions prior to 3.7.1, which stems from vulnerability to buffering attacks that rely on the use of...

PT-2022-18884 · Apache · Apache James

Name of the Vulnerable Software and Affected Versions: Apache James versions prior to 3.6.3 Apache James versions prior to 3.7.1 Description: The issue is related to a buffering attack that relies on the use of the STARTTLS command. It is similar to a previously solved problem in Apache James...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

OESA-2022-1785 evolution-data-server security update

The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user's address book or...

squid: DoS when processing gopher server responses

A vulnerability was found in squid Web proxy cache server. This issue occurs due to improper buffer management while processing Gopher server responses. This flaw leads to a remote denial of service or a crash if it receives specially crafted network traffic, either by mistake or a malicious acto...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

UBUNTU-CVE-2022-29189

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could explo...

UBUNTU-CVE-2022-0322

A flaw was found in the sctpmakestrresetreq function in net/sctp/smmakechunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUGON issue, leading to a denial of service DOS...

The vulnerability of the Redirected Drive Buffering Subsystem in the operating system of Microsoft Windows allows a hacker to disclose protected information.

The vulnerability of the Redirected Drive Buffering Subsystem in the Microsoft Windows operating system is related to information disclosure. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the Redirected Drive Buffering Subsystem in the operating system of Microsoft Windows allows a hacker to disclose protected information.

The vulnerability of the Redirected Drive Buffering Subsystem in the Microsoft Windows operating system is related to information disclosure. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the Redirected Drive Buffering System (rdbss.sys) driver in the Microsoft Windows operating system, which allows a hacker to escalate their privileges.

The vulnerability of the Redirected Drive Buffering System rdbss.sys driver in the Microsoft Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Redirected Drive Buffering Subsystem in the operating system of Microsoft Windows allows a hacker to disclose protected information.

The vulnerability of the Redirected Drive Buffering Subsystem in the Microsoft Windows operating system is related to information disclosure. Exploiting this vulnerability can allow attackers to disclose protected information...

OESA-2022-1561 mutt security update

Mutt is a small but very powerful text-based mail client for Unix operating systems. Security Fixes: Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g...

CVE-2021-3700

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparserserialize in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination...

GSD-2022-1000285 Unsafe default configuration values in Nginx version all version

INFORMATIONAL In Nginx, all versions, a number of unsafe default configuration values exists in the web server that can be attacked via the network resulting in disclosure of information and availability. These include but are not limited to: 1. Not enough file descriptors per worker 2. The...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

Important: kernel

Issue Overview: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service...

Important: kernel

Issue Overview: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service...