GHSA-MC84-PJ99-Q6HH Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10 <=1.1.0), RPD:bmc-rpd (=1.1) +17734 more potentially affected by CVE-2021-35517 via org.apache.commons:commons-compress (>=1.0 <=1.20)

org.apache.commons:commons-compress MAVEN version =1.0, =0.0.10, =0.0.4, =1.0.6, =1.0.6, =0.0.25, =0.0.25, =0.6.0, =0.5.0, =0.9.0, =0.5.0, =0.6.0, =0.11.0, =0.12.0 and more Source cves: CVE-2021-35517 Source advisory: OSV:GHSA-XQFJ-VM6H-2X34...

Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package...

GHSA-XQFJ-VM6H-2X34 Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10 <=1.1.0), RPD:bmc-rpd (=1.1) +17734 more potentially affected by CVE-2021-35516 via org.apache.commons:commons-compress (>=1.0 <=1.20)

org.apache.commons:commons-compress MAVEN version =1.0, =0.0.10, =0.0.4, =1.0.6, =1.0.6, =0.0.25, =0.0.25, =0.6.0, =0.5.0, =0.9.0, =0.5.0, =0.6.0, =0.11.0, =0.12.0 and more Source cves: CVE-2021-35516 Source advisory: OSV:GHSA-CRV7-7245-F45F...

Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package...

GHSA-CRV7-7245-F45F Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10 <=1.1.0), RPD:bmc-rpd (=1.1) +17734 more potentially affected by CVE-2021-35515 via org.apache.commons:commons-compress (>=1.0 <=1.20)

org.apache.commons:commons-compress MAVEN version =1.0, =0.0.10, =0.0.4, =1.0.6, =1.0.6, =0.0.25, =0.0.25, =0.6.0, =0.5.0, =0.9.0, =0.5.0, =0.6.0, =0.11.0, =0.12.0 and more Source cves: CVE-2021-35515 Source advisory: OSV:GHSA-7HFM-57QF-J43Q...

Excessive Iteration in Compress

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package...

GHSA-7HFM-57QF-J43Q Excessive Iteration in Compress

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package...

Oracle JDeveloper XXE (July 2021 CPU)

The version of Oracle JDeveloper installed on the remote host is prior to 12.2.1.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory: - Vulnerability in the Essbase product of Oracle Essbase component: Infrastructure Apache Commons Compress. The...

Apache Commons Compress Resource Management Error Vulnerability (CNVD-2022-62077)

A resource management error vulnerability exists in Apache Commons Compress, a library for processing compressed files from the Apache Foundation, which stems from the fact that when reading a specially crafted 7Z archive, Compress can allocate a large amount of memory, resulting in an...

Denial Of Service (DoS)

commons-compress is vulnerable to denial of service. Lack of proper handling of memory while compressing tar package causes an out of memory error even for very small inputs...

Denial Of Service (DoS)

commons-compress is vulnerable to denial of service. Failure to check the size of PAX header against the size of the current entry allows an attacker to send a malicious 7Z archive to trigger an infinite loop...

CVE-2021-36090

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' zip...

CVE-2021-35516

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' Seven...

CVE-2021-35515

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allows the mounting of a denial of service attack against services that use Compress' SevenZ package...

CVE-2021-35517

A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' TAR...

CVE-2021-36090

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

CVE-2021-35517

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package...