perl-Convert-ASN1 security update

0.27-18 - Fix unsafe decoding in indef case CVE-2013-7488...

kernel: ip_vti: fix potential slab-use-after-free in decode_session6

A use-after-free flaw was found in the Linux kernel's ipvti IPsec Virtual Tunnel Interface implementation when transmitting IPv6 packets with the SFB qdisc attached. A local user with CAPNETADMIN capability can trigger this issue by configuring an ipvti interface with an SFB qdisc and sending IPv...

nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

CVE-2024-35921 media: mediatek: vcodec: Fix oops when HEVC init fails

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed i...

xz:fuzz_decode_stream: Use-of-uninitialized-value in crc32_arch_optimized

Detailed Report: https://oss-fuzz.com/testcase?key=4768769227423744 Project: xz Fuzzing Engine: libFuzzer Fuzz Target: fuzzdecodestream Job Type: libfuzzermsanxz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: crc32archoptimized lzmaindexhashdecode streamdeco...

nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

Important: Red Hat Security Advisory: squid:4 security update

An update for the squid:4 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

squid: Denial of Service in HTTP Chunked Decoding

A flaw was found in Squid. This issue may allow a remote attacker to trigger an uncontrolled recursion bug when sending a specially crafted, chunked, encoded HTTP Message, resulting in a denial of service...

RHEL 8 : squid:4 (RHSA-2024:2822)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2822 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: Denial of Service in HTTP...

RHEL 6 : puppet (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - puppet: incorrect URL decoding CVE-2016-2785 - Versions of Puppet prior to 4.10.1 will deserialize data o...

RHEL 6 : spice (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spice: multiple buffer overflow vulnerabilities in QUIC decoding code CVE-2020-14355 - An issue was...

nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

squid: Denial of Service in HTTP Chunked Decoding

A flaw was found in Squid. This issue may allow a remote attacker to trigger an uncontrolled recursion bug when sending a specially crafted, chunked, encoded HTTP Message, resulting in a denial of service...

libavc:svc_dec_fuzzer: Heap-buffer-overflow in ih264d_format_convert

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=5959942182862848 Project: libavc Fuzzing Engine: afl Fuzz Target: svcdecfuzzer Job Type: aflasanlibavc Platform Id: linux Crash Type:...

PT-2024-24940 · Vitess · Vitess

Name of the Vulnerable Software and Affected Versions: Vitess versions prior to 17.0.7 Vitess versions prior to 18.0.5 Vitess versions prior to 19.0.4 Description: The issue arises when executing a specific query, causing the vtgate to enter an endless loop and consume increasing amounts of memor...

libaom:av1_dec_fuzzer: Segv on unknown address in od_ec_dec_init

Detailed Report: https://oss-fuzz.com/testcase?key=5067078385074176 Project: libaom Fuzzing Engine: afl Fuzz Target: av1decfuzzer Job Type: aflasanlibaom Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: odecdecinit aomreaderinit av1decodetgtilesandwrapup Sanitize...

proton-bridge:fuzz_decode_charset: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5628607660621824 Project: proton-bridge Fuzzing Engine: libFuzzer Fuzz Target: fuzzdecodecharset Job Type: libfuzzerasanproton-bridge Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: NULL Sanitizer: addre...

Fedora 40 : ofono (2024-c42ea059d0)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c42ea059d0 advisory. Update to v2.5 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...