271 matches found
CLSA-2023-1696878189 python: Fix of CVE-2022-48565
CVE-2022-48565: Reject XML entity declarations in plist files...
CLSA-2023-1696878020 python: Fix of CVE-2022-48565
CVE-2022-48565: Reject XML entity declarations in plist files...
CLSA-2023-1696877835 python: Fix of CVE-2022-48565
CVE-2022-48565: Reject XML entity declarations in plist files...
CLSA-2023-1695834624 python3: Fix of 2 CVEs
CVE-2021-3177: Replace snprintf to prevent buffer overflow - CVE-2022-48565: Reject XML entity declarations in plist files...
Debian dla-3575 : idle-python2.7 - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3575 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3575-1 [email protected]...
CLSA-2023-1694538765 Fix CVE(s): CVE-2022-48565
SECURITY UPDATE: XML vulnerabilities in plist files - debian/patches/CVE-2022-48565.patch: Reject XML entity declarations in plist files - CVE-2022-48565...
SUSE CVE-2022-48565
An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities...
SUSE CVE-2009-1686
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant aka const declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or...
SUSE CVE-2009-2414
Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service application crash via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the...
SUSE CVE-2017-18926
raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows sometimes seen in raptorqnameformatasxml...
CVE-2023-22832: Improper Restriction of XML External Entity Reference
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity...
PT-2023-34060
Name of the Vulnerable Software and Affected Versions libbpf versions prior to v5.15.86 Description The issue concerns enum forward-declarations in the public API when libbpf is used in C++ mode. The actual impact and potential for attacks have not been proven yet. Recommendations For versions...
PT-2023-34393 · Libbpf · Libbpf
Name of the Vulnerable Software and Affected Versions: libbpf versions prior to v5.10.163 Description: The issue concerns enum forward-declarations in the public API when libbpf is used in C++ mode. It has been fixed in Linux Kernel version v5.10.163. Recommendations: For versions prior to...
expat: integer overflow in the doProlog function
A flaw was found in expat. The vulnerability occurs due to large content in element type declarations when there is an element declaration handler present which leads to an integer overflow. This flaw allows an attacker to inject an unsigned integer, leading to a crash or a denial of service...
golang: go/parser: stack exhaustion in all Parse* functions
A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability...
expat: integer overflow in the doProlog function
A flaw was found in expat. The vulnerability occurs due to large content in element type declarations when there is an element declaration handler present which leads to an integer overflow. This flaw allows an attacker to inject an unsigned integer, leading to a crash or a denial of service...
Xxe
Apache Calcite 1.22.0 introduced the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM and EXTRACTVALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity XXE attack. Therefore any client exposing these operators,...
SUSE-SU-2022:3194-1 Security update for SUSE Manager Server 4.3
This update fixes the following issues: apache-commons-csv: - Fix the URL for the package - Declare the LICENSE file as license and not doc apache-commons-math3: - Fix the URL for the package - Declare the LICENSE file as license and not doc drools: - Declare the LICENSE file as license and not d...
ASB-A-213323615
In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper input validation. This could lead to local escalation of privilege during app installation or upgrade with no additional execution privileges...
