Important: Red Hat Security Advisory: zlib security update

An update for zlib is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

org.apache.mina:mina-example (1.0.3), org.apache.mina:mina-filter-compression (1.0.3) +4 more potentially affected by CVE-2019-0231 via org.apache.mina:mina-core (1.0.3)

org.apache.mina:mina-core MAVEN version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.3 - org.apache.mina:mina-filter-compression 1.0.3 -...

org.apache.mina:mina-example (1.1.3), org.apache.mina:mina-filter-codec-netty (1.1.3) +5 more potentially affected by CVE-2019-0231 via org.apache.mina:mina-core (1.1.3)

org.apache.mina:mina-core MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.1.3 - org.apache.mina:mina-filter-codec-netty 1.1.3 -...

org.apache.mina:mina-example (1.0.8), org.apache.mina:mina-filter-codec-netty (1.0.8) +5 more potentially affected by CVE-2019-0231 via org.apache.mina:mina-core (1.0.8)

org.apache.mina:mina-core MAVEN version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.8 - org.apache.mina:mina-filter-codec-netty 1.0.8 -...

org.apache.mina:mina-example (1.1.1), org.apache.mina:mina-filter-compression (1.1.1) +3 more potentially affected by CVE-2019-0231 via org.apache.mina:mina-core (1.1.1)

org.apache.mina:mina-core MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.1.1 - org.apache.mina:mina-filter-compression 1.1.1 -...

org.apache.mina:mina-example (1.0.7), org.apache.mina:mina-filter-codec-netty (1.0.7) +5 more potentially affected by CVE-2019-0231 via org.apache.mina:mina-core (1.0.7)

org.apache.mina:mina-core MAVEN version 1.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.7 - org.apache.mina:mina-filter-codec-netty 1.0.7 -...

CVE-2017-9104

An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered...

CLSA-2022-1652987360 Fixed CVE-2018-25032 in rsync

CVE-2018-25032: zlib: A flaw found in zlib when compressing not decompressing certain inputs...

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of distant matches crafted payloads, the buffer into which the compressed or deflated data is written...

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of distant matches crafted payloads, the buffer into which the compressed or deflated data is written...

Important: Red Hat Security Advisory: gzip security update

An update for gzip is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

Xpdf 安全漏洞

Xpdf is an open source PDF reader from FOO Labs. The product supports decoding files in LZW compressed format and reading encrypted PDF files. A security vulnerability exists in Xpdf version 4.04, which stems from an excessive memory allocation when displaying well-designed input...

curl: CVE-2022-32206: HTTP compression denial of service

Summary: Curl does not prevent resource consumption when processing certain header types, but keeps on allocating more and more resources until the application terminates or the system crashes, see below. The attack vectors include at least: - Sending many Transfer-Encodingwith repeated encodings...

PT-2022-5561

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.84.0 Description The issue concerns the support for "chained" HTTP compression algorithms in curl, where a server response can be compressed multiple times with different algorithms. A malicious server can exploit this...

CVE-2020-11612

A flaw was found in Netty in the way it handles the amount of data it compresses and decompresses. The Compression/Decompression codecs should enforce memory allocation size limits to avoid an Out of Memory Error OOME or exhaustion of the memory pool...

[SECURITY] [DLA 3005-1] lrzip security update

Debian LTS Advisory DLA-3005-1 [email protected] https://www.debian.org/lts/security/ Stefano Rivera May 13, 2022 https://wiki.debian.org/LTS Package : lrzip Version : 0.631-1+deb9u3 CVE ID : CVE-2022-28044 lrzip, a compression program, was found to have a heap memory corruption bug. Fo...

minizip, zlib security update

CentOS Errata and Security Advisory CESA-2022:2213 An update for zlib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RHEL 8 : rsync (RHSA-2022:2201)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:2201 advisory. The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only...

Important: Red Hat Security Advisory: zlib security update

An update for zlib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...