CVE-2023-37475 Attacker-controlled parameter can cause denial of service in hamba avro

Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the...

CVE-2023-37475

Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the...

AZL-27667 CVE-2023-35945 affecting package cmake for versions less than 3.21.4-8

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

CVE-2023-35945

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

CVE-2023-35945

CVE-2023-35945 affects Envoy’s HTTP/2 codec. The root cause is in nghttp2 cleanup: after RST_STREAM and subsequent GOAWAY, cleanup of pending requests skips deallocation, leaking header/bookkeeping structures and causing memory exhaustion (DoS). Patched in these versions: 1.26.3, 1.25.8, 1.24.9, ...

CVE-2023-35945 Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

CVE-2023-35945

A flaw was found in Envoy, where a specifically crafted response from an untrusted upstream service can cause a denial of service through memory exhaustion. This issue is caused by Envoy’s HTTP/2 codec, which may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately,...

PT-2023-25396

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.23.11 Envoy versions prior to 1.24.9 Envoy versions prior to 1.25.8 Envoy versions prior to 1.26.3 Description Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST STREAM immediatel...

CVE-2023-35945: Uncontrolled Resource Consumption

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

Security Bulletin: A vulnerability in Apache Commons Code affects IBM Robotic Process Automation and may result in a disclosure of sensitive information. (IBM X-Force ID: 177834)

Summary Apache Commons Codec is used by IBM Robotic Process Automation as part of the IBM Licence and Metrics Tool. IBM X-Force ID: 177834 Vulnerability Details IBM X-Force ID: 177835 DESCRIPTION: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the...

PT-2025-41110

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel related to error handling during MBHC Memory Block Handling Controller initialization within the wcd938x codec. Specifically, the initialization proce...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.12 release and security update

A minor version update from 7.11 to 7.12 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS

A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service DoS...

CVE-2023-21066

In cdCodeMsg of cdcodec.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Memcpy-param-overlap in put_hevc_pel_uni_pixels_10

Detailed Report: https://oss-fuzz.com/testcase?key=4992746590175232 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address: 0xf6635d00,0xf6635d10 and 0xf6635cfc, 0xf6635d0...

PT-2025-41092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ALSA subsystem, specifically within the ac97 codec handling in the snd ac97 mixer function. The issue involves a potential NULL dereference, which cou...

UBUNTU-CVE-2023-34823

fdkaac before 1.0.5 was discovered to contain a stack overflow in readcallback function in src/main.c...

ffmpeg:ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer: Crash in ff_put_h264_chroma_mc4_ssse3

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4993004566609920 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMPEG1VIDEOfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000003c08 Crash...

CVE-2023-33496

xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode...

CVE-2023-33496

CVE-2023-33496 affects XXL-RPC (v1.7.0) and is due to a deserialization vulnerability in the NettyDecode#decode path of the Netty-based remoting codec. The issue allows untrusted data to be deserialized, with sources indicating potential remote code execution. The CVSS 3.1 data reports a critical...