OESA-2024-1607 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the...

The vulnerability of the getBoundName() function in the JIT-compiler of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a malicious actor to execute arbitrary code.

The vulnerability of the getBoundName function in the JIT-compiler of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to access to resources through incompatible types during object processing. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of the JIT-compiler of the Mozilla Firefox browser, which allows a hacker to trigger a service failure.

The vulnerability of the JIT-compiler of the Mozilla Firefox browser is related to an uncontrolled resource consumption due to incorrect object initialization. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability in the compilation of compilers for various programming languages in the GNU Compiler Collection (GCC) relates to the incorrect handling of the sum of a pointer and an integer. This vulnerability allows an attacker to trigger a service failure or cause other adverse effects.

The vulnerability in the compiler set for various programming languages in the GNU Compiler Collection GCC relates to the incorrect handling of the sum of a pointer and an integer, when the sum is greater than or equal to the pointer, without using transformations. This can lead to the...

CVE-2024-34704

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the DAGCombine phase while visiting the XOR operation. The issue arises when attempting to fold the expression !x cc y into x !cc y. To perform this transformation, the second operand o...

CVE-2024-27282

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...

CVE-2024-27282

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...

AZL-40520 CVE-2024-27282 affecting package ruby for versions less than 3.3.3-1

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...

Ruby Security Vulnerabilities

Ruby is a cross-platform, object-oriented, dynamically typed programming language from the individual developer, Yukihiro Matsumoto. A security vulnerability exists in Ruby versions 3.x through 3.3.0, which originates from a user-supplied data provided to the Ruby regular expression compiler can...

ZKsync Era 安全漏洞

ZKsync Era is an open source compiler from Matter Labs. A security vulnerability exists in ZKsync Era versions prior to 1.4.1, which stems from a conversion error...

CVE-2024-34704 era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the DAGCombine phase while visiting the XOR operation. The issue arises when attempting to fold the expression !x cc y into x !cc y. To perform this transformation, the second operand o...

CVE-2024-34704

Summary: CVE-2024-34704 affects era-compiler-solidity (ZKsync Solidity compiler). On instruction selection in the DAGCombine phase, folding the expression !(x cc y) into (x cc y) incorrectly assumed the second XOR operand representing the true value was -1, whereas the true value is 1. This misop...

CVE-2024-34704 era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the DAGCombine phase while visiting the XOR operation. The issue arises when attempting to fold the expression !x cc y into x !cc y. To perform this transformation, the second operand o...

CVE-2024-34704 era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the DAGCombine phase while visiting the XOR operation. The issue arises when attempting to fold the expression !x cc y into x !cc y. To perform this transformation, the second operand o...

PT-2024-26119 · Unknown · Era-Compiler-Solidity

Name of the Vulnerable Software and Affected Versions: era-compiler-solidity versions prior to 1.4.1 Description: The issue occurs during the DAGCombine phase while visiting the XOR operation, specifically when attempting to fold the expression !x cc y into x !cc y. This transformation should be...

CVE-2024-27282

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...

CVE-2024-27282

CVE-2024-27282 affects Ruby 3.x through 3.3.0: attacker-supplied data in the Ruby regex compiler may read arbitrary heap data from the start of the text, including pointers and sensitive strings. Fixed versions: 3.0.7, 3.1.5, 3.2.4, and 3.3.1. Multiple connected advisories reference this CVE and ...

CVE-2024-27282

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...

SUSE-SU-2024:1499-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: - CVE-2024-21011: Fixed denial of service due to long Exception message logging JDK-8319851,bsc1222979 - CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup JDK-8315708,bsc1222987 -...

CVE-2023-50434

emdnsresolveraw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based buffer over-read. This can be triggered by a remote adversary that can send DNS requests to the emdns server. The impact could vary depending on the system...