GO-2023-1990 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...

GO-2023-1989 Excessive resource consumption in golang.org/x/image/tiff

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height, and encoded size to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU...

Excessive Iteration

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...

PT-2023-6962 · Golang +3 · Golang +3

Name of the Vulnerable Software and Affected Versions: Golang affected versions not specified TIFF decoder affected versions not specified Description: The issue is related to the decoding of large amounts of compressed data, which can consume excessive memory and CPU. A maliciously-crafted image...

Allocation of Resources Without Limits or Throttling

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height, and encoded size to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU...

Cisco Nexus 9000 Series Switches Reserved VLAN Number (CVE-2015-6295)

Cisco NX-OS 6.12I34 and 7.03I11 on Nexus 9000 N9K devices allows remote attackers to cause a denial of service CPU consumption or control-plane instability or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560. This plugin only works with...

Denial Of Service (DoS)

wireshark is vulnerable to Denial Of Service DoS. The vulnerability results in the LISP dissector going into a large loop which could allow excessive CPU resource consumption via injecting malformed packets...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. Due to a regex check, the API for changing asset links produced backtracks, resulting in significant CPU consumption for some user-supplied values, causing the application to crash...

UBUNTU-CVE-2023-34966

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop did not validate a field in the network packet that contains the count of elements in an array-like...

PT-2023-4085 · Samba +9 · Samba +9

Name of the Vulnerable Software and Affected Versions: Samba affected versions not specified Description: The issue is related to the sl unpack loop function in Samba's mdssvc RPC service for Spotlight. It does not validate a field in the network packet that contains the count of elements in an...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack due to Golang Go (CVE-2022-41723)

Summary IBM Event Streams is affected by golang / golang-xnet vulnerability for version 0.7.0 CVE-2022-41723 Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By sending a specially-crafted HTTP/2 stream,...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM : Knot Resolver vulnerability (USN-6225-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6225-1 advisory. It was discovered that Knot Resolver did not correctly handle certain client options. A remote attacker could send requests to...

CVE-2022-25883

A Regular Expression Denial of Service ReDoS vulnerability was discovered in node-semver package via the 'new Range' function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size,...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-2292)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Golang Go

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Golang Go. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-24532 DESCRIPTION: An unspecified error with return an incorrect result in the ScalarMult and ScalarBaseMult...

Security Bulletin: IBM Storage Protect server is vulnerable to a denial of service attack due to Golang Go (CVE-2022-41723)

Summary IBM Storage Protect Server component OSSM may be vulnerable in Golang Go, causing denial of service Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By sending a specially-crafted HTTP/2 stream, ...

Security Bulletin: Vulnerabilities in Golang Go might affect IBM Spectrum Copy Data Management ( CVE-2023-24536, CVE-2023-24537, CVE-2023-24538)

Summary Vulnerabilities in Golang Go might affect IBM Spectrum Copy Data Management. Vulnerabilities include the execution of arbitrary code on the system, denial of service attack, as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2023-24536...

CVE-2023-30082

A denial of service attack might be launched against the server if an unusually lengthy password more than 10000000 characters is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all...

CVE-2023-30082

A denial of service attack might be launched against the server if an unusually lengthy password more than 10000000 characters is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service due to org.glassfish.jersey.core_jersey-common

Summary IBM Sterling Partner Engagement Manager has addressed vulnerability mentioned in CVE by updating to latest versions of libraries. Vulnerability Details IBM X-Force ID: 230016 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an error related to some of the...