CVE-2024-25111

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunke...

CVE-2024-25111

Squid (web proxy cache) is affected by CVE-2024-25111. Affected versions are 3.5.27 up to, but not including, 6.8; the issue is an uncontrolled recursion in the HTTP Chunked decoder that can cause a remote DoS when processing crafted chunked HTTP messages. The vulnerability is fixed in Squid vers...

CVE-2024-25111 SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunke...

CVE-2024-25111

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunke...

BIT-GOLANG-2021-27918

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...

BIT-GOLANG-2022-41723 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests...

BIT-HAPROXY-2020-11100

In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution...

CVE-2024-25111: Uncontrolled Recursion

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunke...

Squid 安全漏洞

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A denial of service vulnerability exists in Squid that stems from the presence of a recursion error, which can be...

libaom:av1_dec_fuzzer: Heap-buffer-overflow in od_ec_dec_normalize

Detailed Report: https://oss-fuzz.com/testcase?key=5147169361297408 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1decfuzzer Job Type: libfuzzerasanlibaom Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60f0000004ae Crash State: odecdecnormalize...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in the MediaTek chips, which stems from a privilege bypass in the vdec module, which may exist...

libaom:av1_dec_fuzzer: Heap-buffer-overflow in od_ec_dec_init

Detailed Report: https://oss-fuzz.com/testcase?key=6491968836272128 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1decfuzzer Job Type: libfuzzerasanlibaom Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x611000000382 Crash State: odecdecinit aomreaderinit...

UltraJSON: Multiple Vulnerabilities

Background UltraJSON is an ultra fast JSON encoder and decoder written in pure C with bindings for Python 3.8+. Description Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded...

GLSA-202403-03 : UltraJSON: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202403-03 UltraJSON: Multiple Vulnerabilities - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that...

libaom:av1_dec_fuzzer: Crash in mem_get_varsize

Detailed Report: https://oss-fuzz.com/testcase?key=5056246921101312 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1decfuzzer Job Type: libfuzzerubsanlibaom Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000047ce63da Crash State: memgetvarsize getlstilebuffer...

libaom:av1_dec_fuzzer: Heap-use-after-free in get_ls_tile_buffers

Detailed Report: https://oss-fuzz.com/testcase?key=4768524511805440 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1decfuzzer Job Type: libfuzzerasanlibaom Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x6070000002e8 Crash State: getlstilebuffers...

OESA-2024-1181 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

SUSE CVE-2024-1580

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d...

Potential buffer overflow in CBOR2 decoder

Summary Ever since https://github.com/agronholm/cbor2/pull/204 or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542 was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi ...

GHSA-375G-39JQ-VQ7M Potential buffer overflow in CBOR2 decoder

Summary Ever since https://github.com/agronholm/cbor2/pull/204 or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542 was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi ...