UBUNTU-CVE-2021-43618

GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...

CVE-2021-43618

GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...

CVE-2021-43618

GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...

CVE-2021-42375

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK standards is related to insufficient validation of input data. This allows a perpetrator to execute arbitrary code.

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK is related to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current use...

python-pygments: ReDoS in multiple lexers

A denial of service attack was discovered against pygments. Some of the regular expressions used to tokenise source code for highlighting have exponential complexity. A specially crafted input file could cause pygments to take effectively infinite time to parse, consuming CPU resources and denyin...

openjpeg: out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c

A flaw was found in OpenJPEG. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability...

openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c

A flaw was found in OpenJPEG’s t2 encoder. This flaw allows an attacker who can provide crafted input to be processed by OpenJPEG to cause a NULL pointer dereference issue. The highest threat to this vulnerability is to system availability...

openjpeg: heap-buffer-overflow write in opj_tcd_dc_level_shift_encode()

A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

openjpeg: global-buffer-overflow read in opj_dwt_calc_explicit_stepsizes()

A flaw was found in OpenJPEG’s encoder in the opjdwtcalcexplicitstepsizes function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability...

python-pygments: ReDoS in multiple lexers

A denial of service attack was discovered against pygments. Some of the regular expressions used to tokenise source code for highlighting have exponential complexity. A specially crafted input file could cause pygments to take effectively infinite time to parse, consuming CPU resources and denyin...

PT-2021-5079 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue exists due to insufficient input validation in the Windows Hyper-V component of the Windows operating system. Exploitation of this issue may allow a remote attacker to cau...

PT-2021-23605 · Busybox +3 · Busybox +3

Name of the Vulnerable Software and Affected Versions: Busybox affected versions not specified Description: A NULL pointer dereference in Busybox's hush applet can lead to denial of service when processing a crafted shell command. This issue arises due to missing validation after a x03 delimiter...

PT-2021-23606 · Busybox +3 · Busybox +3

Name of the Vulnerable Software and Affected Versions: Busybox affected versions not specified Description: The issue arises from an attacker-controlled pointer free in Busybox's hush applet, leading to a denial of service and possible code execution when a crafted shell command is processed. Thi...

USN-5133-1: ICU vulnerability

It was discovered that ICU contains a use after free issue. An attacker could use this issue to cause a denial of service with crafted input...

USN-5133-1 A security issue was fixed in ICU

It was discovered that ICU contains a use after free issue. An attacker could use this issue to cause a denial of service with crafted input...

Cisco Firepower Threat Defense 操作系统命令注入漏洞

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. Cisco Firepower Threat Defense Software suffers from operating system command injection vulnerabilities that stem from insufficient validation of user-supplied command...

CVE-2021-3802

A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability...