Uncontrolled Recursion

Overview std/encoding/xml is a Go standard library package std/encoding/xml Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report: Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion. Remediation...

Fedora: Security Advisory for golang-github-burntsushi-toml-test (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-francoispqt-gojay-1.2.13-7.fc35

GoJay is a performant JSON encoder/decoder for Golang currently the most performant, see benchmarks. It has a simple API and doesn't use reflection. It relies on small interfaces to decode/encode structures and slices. Gojay also comes with powerful stream decoding features and an even faster...

[SECURITY] Fedora 35 Update: golang-github-burntsushi-toml-test-0.2.0-11.20210108git9767d20.fc35

Toml-test is a higher-order program that tests other TOML decoders or encoder s. The goal is to make it comprehensive. Tests are divided into two groups: inva lid TOML data and valid TOML data. Decoders that reject invalid TOML data pass invalid TOML tests. Decoders that accept valid TOML data an...

graphicsmagick:coder_JPC_fuzzer: Heap-buffer-overflow in jpc_dec_tiledecode

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5340746521116672 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderJPCfuzzer Job Type: libfuzzerasani386graphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ...

CVE-2022-30635

A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...

FFmpeg HEVC video decoder denial of service vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A denial of service vulnerability exists in FFmpeg HEVC video decoder, which can be exploited by attackers to cause a denial of service attack...

javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6637560876630016 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

CVE-2022-31117

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is...

CVE-2022-31116

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

libvpx:vpx_dec_fuzzer_vp9: Index-out-of-bounds in decode_coefs

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=5146665455058944 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxdecfuzzervp9 Job Type: libfuzzerubsanlibvpx Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer: Heap-buffer-overflow in lag_decode_arith_plane

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4764457825337344 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDLAGARITHfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 9 Crash Address:...

libvpx:vpx_dec_fuzzer_vp9: Segv on unknown address in vp9_remove_common

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=5068192141148160 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxdecfuzzervp9 Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Segv on unknown address Crash Address: Cra...

libvpx:vpx_dec_fuzzer_vp9: Check failed in CheckUnwind

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=4942741112487936 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxdecfuzzervp9 Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Check failed Crash Address: Crash State:...

Fedora: Security Advisory for golang-github-francoispqt-gojay (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-31116

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

CVE-2022-31116

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

CVE-2022-31116

UltraJSON vulnerability (CVE-2022-31116) affects UltraJSON, a C-based JSON encoder/decoder with Python bindings. Affected versions improperly decoded escaped surrogate characters (surrogate pairs), enabling string corruption and potential key confusion or value overwriting when parsing JSON from ...

CVE-2022-31116

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

CVE-2022-31116: Always-Incorrect Control Flow Implementation

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...