CLSA-2024-1717691762 libxml2: Fix of 2 CVEs

CVE-2023-29469: dict.c: fix non-deterministic hashing of empty dict strings - CVE-2023-28484: fix NULL pointer dereferences in xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK...

PT-2024-27149 · Oneflow · Oneflow

Name of the Vulnerable Software and Affected Versions: Oneflow version 0.9.1 Description: An issue in OneFlow-Inc. Oneflow allows attackers to cause a Denial of Service DoS when an empty array is processed with oneflow.dot. Recommendations: For version 0.9.1, consider avoiding the use of...

CVE-2024-36732: Loop with Unreachable Exit Condition

An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service DoS when an empty array is processed with oneflow.tensordot...

PT-2024-27141 · Oneflow · Oneflow

Name of the Vulnerable Software and Affected Versions: Oneflow version 0.9.1 Description: The issue allows attackers to cause a Denial of Service DoS when an empty array is processed with oneflow.tensordot. Recommendations: For version 0.9.1, consider avoiding the use of oneflow.tensordot with...

PT-2024-19340 · Ibm · Ibm System Storage Ds8900F

Name of the Vulnerable Software and Affected Versions: IBM System Storage DS8900F versions 89.22.19.0 through 89.40.93.0 Description: The issue allows a remote user to create an LDAP connection with a valid username and an empty password, potentially establishing an anonymous connection...

Microsoft Artifact Registry Container Images Empty Password Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Artifact Registry Container images. Authentication is not required to exploit this vulnerability. The specific flaw exists within the default credentials set within the image. The issue...

PT-2024-40141

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises from the default authentication service failing to invalidate empty strings as passwords, allowing authentication of backend and frontend users without a password set in the...

ron:from_str: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6472212835008512 Project: ron Fuzzing Engine: libFuzzer Fuzz Target: fromstr Job Type: libfuzzerasanron Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

upx:list_packed_file_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4775331922771968 Project: upx Fuzzing Engine: libFuzzer Fuzz Target: listpackedfilefuzzer Job Type: libfuzzerubsanupx Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ffd9ef80580 Crash State: NULL Sanitizer: undefined UBSAN...

BELL-CVE-2024-36884

Bulletin has no description...

ecdsa-python:fuzz_private_key: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4752394549264384 Project: ecdsa-python Fuzzing Engine: libFuzzer Fuzz Target: fuzzprivatekey Job Type: libfuzzerasanecdsa-python Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x515041923cf1 Crash State: NULL Sanitizer: address ASAN...

[SECURITY] Fedora 39 Update: rust-uu_rmdir-0.0.23-3.fc39

rmdir uutils remove empty DIRECTORY...

SUSE CVE-2024-36891

In the Linux kernel, the following vulnerability has been resolved: mapletree: fix masemptyarearev null pointer dereference Currently the code calls masstart followed by masdataend if the maple state is MASTART, but masstart may return with the maple state node == NULL. This will lead to a null...

wabt:read_binary_interp_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6315491927851008 Project: wabt Fuzzing Engine: libFuzzer Fuzz Target: readbinaryinterpfuzzer Job Type: libfuzzerubsanwabt Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x5ab50000000f Crash State: NULL Sanitizer: undefined UBSAN...

zstd: mysql: buffer overrun in util.c

A vulnerability was found in zstd. This flaw allows an attacker to supply an empty string as an argument to the command line tool to cause a buffer overrun...

DEBIAN-CVE-2024-36891

In the Linux kernel, the following vulnerability has been resolved: mapletree: fix masemptyarearev null pointer dereference Currently the code calls masstart followed by masdataend if the maple state is MASTART, but masstart may return with the maple state node == NULL. This will lead to a null...

UBUNTU-CVE-2024-36891

In the Linux kernel, the following vulnerability has been resolved: mapletree: fix masemptyarearev null pointer dereference Currently the code calls masstart followed by masdataend if the maple state is MASTART, but masstart may return with the maple state node == NULL. This will lead to a null...

PT-2024-40463 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises when creating new backend user accounts in the TYPO3 backend, potentially leading to database records with insecure or empty credentials being persisted. This occurs when the...

SUSE CVE-2023-52811

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUGON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUGON, a...

PT-2024-34664 · WordPress · Login With Phone Number

Name of the Vulnerable Software and Affected Versions: Login with phone number plugin for WordPress versions up to 1.7.26 Description: The issue is related to authentication bypass due to the activation code default value being empty and a missing not empty check in the lwp ajax register function...