libxml2: Fix of 2 CVEs

CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...

CLSA-2022-1670518262 Fix CVE(s): CVE-2022-40303, CVE-2022-40304

SECURITY UPDATE: Integer overflows with XMLPARSEHUGE - debian/patches/CVE-2022-40303.patch: Impose size limits when XMLPARSEHUGE is set and add length checks to core parser functions - CVE-2022-40303 SECURITY UPDATE: Dict corruption caused by entity reference cycles -...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

Security Bulletin: FasterXML Jackson Databind used by CICS Transaction Gateway could provide weaker than expected security

Summary FasterXML Jackson Databind used by CICS Transaction Gateway could provide weaker than expected security, caused by not having entity expansion secured properly CVE-2020-25649. CICS Transaction Gateway addressed the applicable CVE. Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION:...

JetBrains IntelliJ IDEA 代码问题漏洞

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2022.3, which stems from an XXE attack that can be performed via a request to a custom plugi...

PT-2022-27984 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.3 Description: The issue allows for an XXE attack, which can lead to a Server-Side Request Forgery SSRF via requests to custom plugin repositories. This occurs due to a flaw in handling requests ...

MAL-2022-2 Malicious code in --hiljson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 346600b3c428f935cffe333f73dbf2bd10ff54fce19d9349db9de380ddc45de8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in securityrele (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 185b542d66b1e73e39974ac16964546da7a68898526013750a29430a2454aab7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5533 Malicious code in pv_ho3ein (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7aa33fb89a5d7bd38f7efcced8a18b26c18b81d9e112bfd15547d569cee8f2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Plot Plugin 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A code issue vulnerability...

PT-2022-27946 · Jenkins · Jenkins Plot Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plot Plugin versions 2.1.11 and earlier Description: The issue allows attackers who can control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of...

Entity Registration - Moderately critical - Access bypass - SA-CONTRIB-2022-063

This module enables you to create registration entities related to nodes. The module doesn't sufficiently restrict update access to a user's own registrations. This vulnerability is mitigated by the fact that an attacker must have the "update own registration type" permission...

CVE-2022-46682

Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-46682

Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-45326

An XML external entity XXE injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery SSRF attacks...

CVE-2022-45326

An XML external entity XXE injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery SSRF attacks...

Design/Logic Flaw

An XML external entity XXE injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery SSRF attacks...

Malicious code in arpan-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94611fae33d6748195d928999375279918e9af944e726bf73a25f75a3ae15d5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...