The vulnerability of the scan_ps() function in the libppd library of the CUPS printing server allows a attacker to escalate their privileges and execute arbitrary code.

The vulnerability of the scanps function in the libppd library of the CUPS printing server is related to the issue where the operation’s output goes out of the buffer in memory when processing PPD file lengths. Exploiting this vulnerability can allow an attacker to increase their privileges and...

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

Summary Tornado interprets -, +, and in chunk length and Content-Length values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older...

PT-2023-33054 · Haproxy +1 · Haproxy +1

Name of the Vulnerable Software and Affected Versions: Tornado versions prior to the version that includes the fix for this issue Description: The issue arises from Tornado's interpretation of non-standard characters in chunk length and Content-Length values, which can lead to request smuggling...

PT-2023-7830

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio crypto handle sym req. There is no check for the value of src len and dst len in...

The vulnerability of the IPerf3 network bandwidth measurement tool, related to integer overflows, allows a hacker to cause a service failure.

The vulnerability of the IPerf3 network bandwidth measurement tool is related to integer overflows during the processing of field lengths. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2023-24604

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data...

CVE-2023-24604

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

XKCP: buffer overflow in the SHA-3 reference implementation

A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows partial input data to be processed, and partial output to be produced. When at least one of these has a length of 4294967096 bytes or more, it can result in elimination of cryptographic...

USN-6063-1: Ceph vulnerabilities

Mark Kirkwood discovered that Ceph incorrectly handled certain key lengths. An attacker could possibly use this issue to create non-random encryption keys. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-3979 It was discovered that Ceph incorrectly handled the volumes...

CVE-2021-46753

Failure to validate the length fields of the ASP AMD Secure Processor sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity...

[M-1] Potential DoS attack due to unchecked array lengths in loop

Lines of code Vulnerability details M-1 Potential DoS attack due to unchecked array lengths in loop Impact If strategies and shares have different lengths and the code uses them in a loop without checking their lengths, it could potentially cause an out-of-bounds error, which could lead to a...

PT-2023-8721 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel has a vulnerability related to the handling of non-PAGE SIZE-end multi-iovec user SDMA requests in the hfi1 driver. This vulnerability can cause data corruption for us...

Medium: dbus

Issue Overview: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. CVE-2022-42010 An...

Denial Of Service (DoS)

tensorflow is vulnerable to Denial of Service DoS attacks. The vulnerability is due to a floating point exception in TensorListSplit because it does not check for negative lengths, causing the application to crash...

Important: Red Hat Security Advisory: nss security and bug fix update

An update for nss is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

SUSE CVE-2006-4519

Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in 1 DICOM, 2 PNM, 3 PSD, 4 PSP, 5 Sun RAS, 6 XBM, and 7 XWD files...

SUSE CVE-2009-0135

Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio .aa file with a large 1 nlen or 2 vlen Tag value, each of which triggers a heap-based buffer...

SUSE CVE-2009-2675

Integer overflow in the unpack200 utility in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to...

SUSE CVE-2011-4914

The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service out-of-bounds read via...