Python -- multiple vulnerabilities

Python reports: bpo-43434: Creating a sqlite3.Connection object now also produces a sqlite3.connect auditing event. Previously this event was only produced by sqlite3.connect calls. Patch by Erlend E. Aasland. bpo-43882: The presence of newline or tab characters in parts of a URL could allow some...

OSV-2021-435 Stack-buffer-overflow in ot::Cli::Interpreter::OutputFormatV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31232 Crash type: Stack-buffer-overflow READ Crash state: ot::Cli::Interpreter::OutputFormatV ot::Cli::Interpreter::OutputLine ot::Cli::Interpreter::HandleDnsServiceResponse...

PT-2021-28110

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read crash. Technical details about the crash include the not::Cli::Interpreter::OutputFormatV,...

openthread:cli-uart-received-fuzzer: Stack-buffer-overflow in ot::Cli::Interpreter::OutputFormatV

Project: https://github.com/openthread/openthread.git Detailed Report: https://oss-fuzz.com/testcase?key=5130133885288448 Project: openthread Fuzzing Engine: libFuzzer Fuzz Target: cli-uart-received-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash Type: Stack-buffer-overflow READ...

OSV-2021-411 UNKNOWN READ in ot::Cli::Interpreter::OutputFormatV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31002 Crash type: UNKNOWN READ Crash state: ot::Cli::Interpreter::OutputFormatV ot::Cli::Interpreter::OutputLine ot::Cli::SrpServer::ProcessDomain...

PT-2021-28096

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several components, including not::Cli::Interpreter::OutputFormatV,...

openthread:cli-uart-received-fuzzer: Crash in ot::Cli::Interpreter::OutputFormatV

Project: https://github.com/openthread/openthread.git Detailed Report: https://oss-fuzz.com/testcase?key=5994577288888320 Project: openthread Fuzzing Engine: afl Fuzz Target: cli-uart-received-fuzzer Job Type: aflasanopenthread Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

The vulnerability of the _proc_pax function (Lib/tarfile.py) in the Python programming language allows a attacker to cause a service failure.

The vulnerability of the procpax function in the Lib/tarfile.py module of the Python interpreter is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

The vulnerability of the PHP programming language interpreter, related to improper storage of permissions, allows attackers to compromise data integrity.

The vulnerability of the PHP programming language interpreter is related to improper storage of permissions. Exploiting this vulnerability allows an attacker to influence the integrity of data...

USN-4686-1: Ghostscript vulnerabilities

It was discovered that Ghostscript incorrectly handled certain image files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary co...

CVE-2020-26292

Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source...

Input validation

Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source...

CVE-2020-26292 Potential Malware Discovered (Possible False Positive)

Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source...

CVE-2020-26292

CVE-2020-26292 concerns Creeper, an experimental dynamic language. The vulnerability is limited to the binary release of Creeper Interpreter 1.1.3, not the source code. The compromised binary was briefly available on Dec 26, 2020 (about 3:22 PM–11:00 PM EST) and has since been removed. If you dow...

CVE-2020-26292: Trojan Horse

Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source...

PT-2021-11233

Name of the Vulnerable Software and Affected Versions: Creeper Interpreter version 1.1.3 Description: The binary release of Creeper Interpreter contains potential malware. The compromised binary was available for download between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM...

The vulnerability of the mbfl_filt_conv_big5_wchar function in the PHP interpreter allows a hacker to access protected information or cause service failures.

The vulnerability of the mbflfiltconvbig5wchar function in the PHP interpreter arises due to an operation being performed outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to gain access to protected information or cause service failures...

The vulnerability of the Lua interpreter used in Cisco IOS XE operating systems allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the Lua interpreter used in Cisco IOS XE operating systems is related to insufficient restrictions on function calls. Exploiting this vulnerability allows an attacker to execute arbitrary code with root privileges...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service DoS. The vulnerability exists as the tf.rawops.ImmutableConst operation crashes the Python interpreter when it tries to write the immutable memory area, if the type of the tensor is not an integral type...

CVE-2020-26268

In affected versions of TensorFlow the tf.rawops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the...