A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.

...

CVE-2023-33613

axTLS v2.1.5 was discovered to contain a heap buffer overflow in the biimport function in axtls-code/crypto/bigint.c. This vulnerability allows attackers to cause a Denial of Service DoS when parsing a private key...

CVE-2023-33613

CVE-2023-33613 affects axTLS v2.1.5 and is caused by a heap buffer overflow in the bi_import function (axtls-code/crypto/bigint.c). This vulnerability allows a Denial of Service when parsing a private key. The provided connected sources describe the flaw but do not provide concrete exploitation d...

CVE-2023-33659

A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmqsubinfodecode in the file mqttparser.c. An attacker could exploit this vulnerability to cause a denial of service attack...

CVE-2023-33613

axTLS v2.1.5 was discovered to contain a heap buffer overflow in the biimport function in axtls-code/crypto/bigint.c. This vulnerability allows attackers to cause a Denial of Service DoS when parsing a private key...

CVE-2023-33659

A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmqsubinfodecode in the file mqttparser.c. An attacker could exploit this vulnerability to cause a denial of service attack...

OSV-2023-455 Heap-buffer-overflow in bit_TV_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59571 Crash type: Heap-buffer-overflow WRITE 1 Crash state: bitTVtoutf8 jsoncquote dwggeojsonfeature...

CVE-2023-32643

A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initi...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : LibRaw vulnerabilities (USN-6137-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6137-1 advisory. It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially...

PT-2023-35858 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow WRITE 1 crash has been reported, involving functions such as bit TV to utf8, json cquote, and dwg geojson feature. Recommendations...

Denial Of Service (DoS)

OpenPrinting CUPS is vulnerable to Denial Of Service DoS. The vulnerability exists due to the heap buffer overflow in the formatlogline of the library, which allows an attacker to cause an application crash when the configuration file cupsd.conf sets the value of loglevel to DEBUG...

OSV-2023-452 Heap-buffer-overflow in json_write_TF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59523 Crash type: Heap-buffer-overflow READ Crash state: jsonwriteTF dwgjsonLTYPE jsonobjectswrite...

SUSE SLES12 Security Update : openvswitch (SUSE-SU-2023:2360-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2360-1 advisory. - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV bsc1206580. - CVE-2022-4337: Fixed Out-of-Bounds Read in...

PT-2023-35856 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash has been reported, involving functions such as json write TF, dwg json LTYPE, and json objects write. Recommendations: ...

OSV-2023-451 Heap-buffer-overflow in BundlePacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59498 Crash type: Heap-buffer-overflow WRITE 9 Crash state: BundlePacket SendChannelExit wolfSSHshutdown...

CBL Mariner 2.0 Security Update: qt5-qtbase (CVE-2023-20958)

The version of qt5-qtbase installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-20958 advisory. - In readpaint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This cou...

SUSE SLED15: cups / cups-client / cups-config / cups-ddk / cups-devel / etc (SUSE-SU-2023:2347-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2347-1 advisory. - CVE-2023-32324: Fixed a buffer overflow in formatlogline which could cause a denial-of-service...

SUSE SLES12: cups / cups-client / cups-ddk / cups-devel / cups-libs / etc (SUSE-SU-2023:2346-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2346-1 advisory. - CVE-2023-32324: Fixed a buffer overflow in formatlogline which could cause a denial-of-service bsc1211643. Tenable has extracted the...

Debian dla-3440 : cups - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3440 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3440-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-32324

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer overflow vulnerability in the function formatlogline could allow remote attackers to cause a DoS ...