3292 matches found
golang: encoding/gob: stack exhaustion in Decoder.Decode
A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...
PT-2022-37155 · Git +1 · Libredwg
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow WRITE 4 crash type. The crash state involves functions such as decode preR13 section hdr, decode preR13, a...
golang: encoding/gob: stack exhaustion in Decoder.Decode
A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...
OESA-2022-1783 golang security update
The Go Programming Language Security Fixes: When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more...
Improper Input Validation
@openzeppelin/contracts and @openzeppelin/contracts-upgradeable are vulnerable to improper input validation. The vulnerability exists because an incorrect assumption about Solidity 0.8's abi.decode allows ERC165Checker to revert instead of returning false via a specifically crafted input request...
Authentication Bypass
@openzeppelin/contractsvulnerable to improper input validation. The vulnerability exists in the ERC165Checker function in ERC165Checker.sol and ERC165CheckerUpgradeable function in ERC165CheckerUpgradeable.sol due to the incorrect assumption about abi.decode which allows a malicious user to pass ...
CVE-2022-31172
OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to...
PT-2022-6681 · FFmpeg +6 · Ffmpeg +6
Name of the Vulnerable Software and Affected Versions: FFmpeg affected versions not specified Description: A null pointer dereference issue was discovered in the decode main header function of the libavformat/nutdec.c file. The flaw occurs because the function lacks a check of the return value of...
CVE-2022-31170
OpenZeppelin Contracts (library for smart contract development) contains a vulnerability in versions 4.0.0 through 4.7.1 where ERC165Checker.supportsInterface may revert instead of returning false due to an incorrect assumption about Solidity 0.8 abi.decode. This affects contracts that use ERC165...
PT-2022-20586 · Openzeppelin · Openzeppelin Contracts
Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions 4.1.0 through 4.7.1 Description: The issue concerns the SignatureChecker reverting in certain cases, which is not expected. This occurs due to an incorrect assumption about Solidity 0.8's abi.decode, specifical...
The vulnerability in the implementation of the mutt_decode_uuencoded() function in the Mutt email client allows a hacker to gain unauthorized access to protected information or cause service failures.
The vulnerability of the muttdecodeuuencoded function in the Mutt email client is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause service failures...
Medium: amazon-ssm-agent
Issue Overview: A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input more than 5 MB , causing a stack overflow in Decode, which leads to a loss of availability. CVE-2022-24675 Affected Packages: amazon-ssm-agent Note: This adviso...
FFmpeg decode_slice_header() function denial of service vulnerability
FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A denial of service vulnerability exists in the FFmpeg decodesliceheader function, which can be exploited by an attacker to cause a denial of service attack...
The vulnerability in the libImaging/TgaRleDecode.c component of the Pillow image processing library allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the libImaging/TgaRleDecode.c component of the Pillow image processing library is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...
Malformed CAR panics and excessive memory usage
Impact Versions impacted = [email protected] = [email protected] Description of user-facing changes...
The vulnerability of the decode/encodeBody component in the Envoy proxy server allows a attacker to induce a service failure.
The vulnerability of the decode/encodeBody component in the Envoy proxy server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by uploading a specially created zip file...
PHP Library Remote Code Execution Vulnerability
Several PHP compatibility libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existing vulnerable code. Affected components include the WassUp Realtime analytics WordPress plugin, AjaXplorer Core, and more. JAHx221 - RCE in copy/pasted...
golang: encoding/pem: fix stack overflow in Decode
A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input more than 5 MB, causing a stack overflow in Decode, which leads to a loss of availability...
Buffer Overflow
Overview Affected versions of this package are vulnerable to Buffer Overflow. In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData. Remediation Upgrade tinyexr to version 1.0.6 or higher. References - GitHub Issue...