CVE-2024-45296: Inefficient Regular Expression Complexity

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

libvirt: stack use-after-free in virNetClientIOEventLoop()

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's...

Fedora 39 : libvirt (2024-c2e7b82022)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c2e7b82022 advisory. Fix crash in event loop CVE-2024-4418 Fix I/O stall when multiple threads issue RPC calls Fix leak of GSource object Fix leak of udev object referen...

Fedora 40 : libvirt (2024-ee96e0c470)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ee96e0c470 advisory. Fix crash in event loop CVE-2024-4418 Fix leak of GSource object Fix leak of udev object reference Tenable has extracted the preceding description...

SUSE-SU-2024:1962-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2024-4418: Fixed a stack use-after-free by ensuring temporary GSource is removed from client event loop. bsc1223849...

Fedora: Security Advisory for glib2 (FEDORA-2024-635a54eb7e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: glib2-2.78.6-1.fc39

GLib is the low-level core library that forms the basis for projects such as GTK+ and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system...

DEBIAN-CVE-2024-4418

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's...

UBUNTU-CVE-2024-4418

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's...

Fedora: Security Advisory (FEDORA-2024-d6a850992f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for libuev (FEDORA-2024-75e1256954)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: libuev-2.4.1-1.fc40

libuEv is a small event loop that wraps the Linux epoll family of APIs. It is similar to the more established libevent, libev and the venerable Xt3 event loop. The =EF=BF=BD=EF=BF=BD in the name refers to both its limited feature set and the size impact of the library...

[SECURITY] Fedora 38 Update: libuev-2.4.1-1.fc38

libuEv is a small event loop that wraps the Linux epoll family of APIs. It is similar to the more established libevent, libev and the venerable Xt3 event loop. The =EF=BF=BD=EF=BF=BD in the name refers to both its limited feature set and the size impact of the library...

[SECURITY] Fedora 39 Update: libuev-2.4.1-1.fc39

libuEv is a small event loop that wraps the Linux epoll family of APIs. It is similar to the more established libevent, libev and the venerable Xt3 event loop. The =EF=BF=BD=EF=BF=BD in the name refers to both its limited feature set and the size impact of the library...

python-multipart Resource Management Error Vulnerability

python-multipart is a streaming multipart parser for Python by the individual developer Marcelo Trylesinski. A resource management error vulnerability exists in versions prior to python-multipart 0.0.7, which stems from the package python-multipart consuming CPU resources and stopping indefinitel...

GHSA-9H6G-PR28-7CQP nodemailer ReDoS when trying to send a specially crafted email

Summary A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. Details Regex:...

nodemailer ReDoS when trying to send a specially crafted email

Summary A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. Details Regex:...

PT-2026-83722

Name of the Vulnerable Software and Affected Versions nodemailer versions prior to 6.9.9 Description A Regular Expression Denial of Service ReDoS occurs during email parsing when the attachDataUrls parameter is enabled or when processing embedded file attachments. An attacker can send specially...

libuev Security Vulnerabilities

libuev is a lightweight event loop library for the Linux epoll family of APIs by the individual developer Joachim Wiberg. A security vulnerability exists in libuev versions prior to 2.4.1, which stems from the presence of a buffer overflow vulnerability...

SUSE CVE-2019-11691

A use-after-free vulnerability can occur when working with XMLHttpRequest XHR in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 60.7, Firefox 67, and Firefox ESR 60.7...