CVE-2022-24903: A flaw in rsyslog TCP module could allows an attacker to craft a malicious message leading to a heap-based buffer overflow.

Rsyslog is vulnerable to remote code execution RCE due to improper validation of input data when octet-counted framing is used. An attacker could exploit this vulnerability by supplying a system with maliciously crafted messages. Products Affected. Brocade SANnav - Fixed in Brocade SANnav 2.2.1...

Moderate: yajl security update

Yet Another JSON Library YAJL is a small event-driven SAX-style JSON parser written in ANSI C and a small validating JSON generator. Security Fixes: yajl: heap-based buffer overflow when handling large inputs due to an integer overflow CVE-2022-24795 For more details about the security issues,...

CVE-2022-24903: A flaw in rsyslog TCP module could allow an attacker to craft a malicious message leading to a heap-based buffer overflow. (BSA-2022-2127)

Security Advisory ID: BSA-2022-2127 Component: Rsyslog Revision: 1.0 Rsyslog is vulnerable to remote code execution RCE due to improper validation of input data when octet-counted framing is used. An attacker could exploit this vulnerability by supplying a system with maliciously crafted messages...

Siemens Teamcenter Visualization and JT2Go

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2022-39136

A vulnerability has been identified in JT2Go All versions = V13.3.0.7 V13.3.0.8, Teamcenter Visualization V14.0 All versions V14.0.0.3, Teamcenter Visualization V14.1 All versions V14.1.0.4. The affected application is vulnerable to fixed-length heap-based buffer while parsing specially crafted T...

RHEL 8 : yajl (RHSA-2022:7524)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7524 advisory. Yet Another JSON Library YAJL is a small event-driven SAX-style JSON parser written in ANSI C and a small validating JSON generator. Security Fixes:...

SUSE SLES12 Security Update : sudo (SUSE-SU-2022:3886-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2022:3886-1 advisory. - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt password...

FreeBSD : sudo -- Potential out-of-bounds write for small passwords (3310014a-5ef9-11ed-812b-206a8a720317)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3310014a-5ef9-11ed-812b-206a8a720317 advisory. - Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c...

Denial Of Service (DoS)

upx is vulnerable to denial of service. The vulnerability exists due to the heap-based buffer over-read in the getle64 function of bele.h, allowing an attacker to crash the application through the maliciously crafted Mach-O file...

Denial Of Service (DoS)

upx is vulnerable to denial of service. The vulnerability exists due to the heap-based buffer over-read in the getle32 function of bele.h, allowing an attacker to crash the application through the maliciously crafted Mach-O file...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current sudo Vulnerability (SSA:2022-309-01)

The version of sudo installed on the remote host is prior to 1.9.12p1. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-309-01 advisory. - Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that...

EulerOS 2.0 SP5 : zlib (EulerOS-SA-2022-2715)

According to the versions of the zlib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only...

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-158)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-158 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

Amazon Linux 2022 : libsepol, libsepol-devel, libsepol-static (ALAS2022-2022-170)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-170 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission and cilpreverifyhelper. CVE-2021-36084 The CIL compiler in SELinux 3.2 has a...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of integrity due to CVE-2022-1621

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of integrity. This bulletin provides...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-2124, CVE-2022-2125, CVE-2022-2126 and CVE-2022-2129

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Buffer Overflow

giflib is vulnerable to heap-based buffer overflow. The vulnerability exists in function DumpScreen2RGB in gif2rgb.c which allows an attacker to cause a buffer overflow...

Denial Of Service (DoS)

libde265.so is vulnerable to denial of service DoS. A heap-based-buffer-overflow vulnerability is due the putepelhvfallback function in fallback-motion.cc, which allows a remote attacker to cause denial of service conditions via a crafted video file...

Denial Of Service (DoS)

libde265.so is vulnerable to denial of service. The vulnerability exists due to a heap-based buffer overflow in the mcchroma function of motion.cc which allows an attacker to cause an application crash...

Denial Of Service (DoS)

libde265.so is vulnerable to denial of service DoS. A heap-based-buffer-overflow vulnerability exists due to the function putweightedpredavg16fallback in fallback-motion.cc, which allows a remote attacker to cause denial of service via a crafted video file...