OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...

Moderate: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: OpenJDK: improper MultiByte conversion can lead to buffer overflow JGSS, 8286077 CVE-2022-21618 OpenJDK: excessive memory allocation in X.509 certificate...

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...

Updated unzip packages fix security vulnerability

Improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2021-4217 Conversion of a wide string to a local string that leads to a heap of out-of-bound write. Thi...

PT-2022-6861

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19 Oracle GraalVM Enterprise Edition versions 20.3.7, 21.3.3, 22.2.0 Description The issue is related to an error in integer value conversion in the Security component of Oracle...

[SECURITY] [DLA 3152-1] glibc security update

Debian LTS Advisory DLA-3152-1 [email protected] https://www.debian.org/lts/security/ Helmut Grohne October 17, 2022 https://wiki.debian.org/LTS Package : glibc Version : 2.28-10+deb10u2 CVE ID : CVE-2016-10228 CVE-2019-19126 CVE-2019-25013 CVE-2020-1752 CVE-2020-6096 CVE-2020-10029...

Arbitrary Code Execution

hermes-engine is vulnerable to arbitrary code execution. The vulnerability exists due to the integer conversion error in the library, which performs out-of-bounds operations and subsequently executes arbitrary code execution, resulting in an application crash...

The vulnerability of the Hermes JS JavaScript engine, related to the lack of data type conversion mechanisms, allows attackers to execute arbitrary code.

The vulnerability of the Hermes JS engine is related to the lack of a mechanism for type conversion. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2022-40138

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute...

CVE-2022-40138

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute...

Design/Logic Flaw

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute...

CVE-2022-40138

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute...

CVE-2022-40138

CVE-2022-40138 affects Hermes, the JavaScript engine used by React Native. The issue is an integer conversion error in Hermes bytecode generation (before commit 6aa825e480d48127b480b08d13adf70033237097) that could allow out-of-bounds operations and arbitrary code execution when untrusted JavaScri...

PT-2022-5008 · Facebook · Hermes

Name of the Vulnerable Software and Affected Versions: Hermes versions prior to commit 6aa825e480d48127b480b08d13adf70033237097 Description: The issue is related to an integer conversion error in Hermes bytecode generation. This error could be used to perform Out-Of-Bounds operations and...

Amazon Linux 2 : ruby (ALAS-2022-1853)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1853 advisory. A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes...

EulerOS Virtualization 3.0.6.6 : ruby (EulerOS-SA-2022-2536)

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV...

Updated python3 packages fix security vulnerability

Converting between int and str in bases other than 2 binary, 4, 8 octal, 16 hexadecimal, or 32 such as base 10 decimal now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. CVE-2020-10735...

The vulnerability of the Corel PDF Fusion software for converting PDF files, related to buffer overflow attacks, allows attackers to execute arbitrary code within the context of the current user.

The vulnerability of the Corel PDF Fusion software for converting PDF files is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using the malicious PDF file as a means to do so...

FFmpeg Buffer Overflow Vulnerability (CNVD-2022-70582)

FFmpeg is software developed by individual developers that performs recording, converting, and streaming functions for a wide range of audio and video formats. A buffer overflow vulnerability exists in FFmpeg where the size calculation in buildopengopkeypoints iterates over all entries in the loo...