golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

DEBIAN-CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

Denial Of Service (DoS)

Xen is vulnerable to denial of service. A malicious guest administrator is able to cause management tools and debugging operations to fail by creating paths in its own namespace that are too long...

DEBIAN-CVE-2020-29482

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily usi...

zsh: buffer overflow when scanning very long directory paths for symbolic links

A buffer overflow flaw was found in the zsh shell symbolic link resolver. A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do symbolic link resolution in the aforementioned path. An attacker could exploi...

DEBIAN-CVE-2014-10072

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links...

Design/Logic Flaw

The aspathput function in bgpd/bgpaspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service session drop via BGP UPDATE messages, because ASPATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message...

UBUNTU-CVE-2017-16227

The aspathput function in bgpd/bgpaspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service session drop via BGP UPDATE messages, because ASPATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message...

security flaw

slocate before 2.7 does not properly process very long paths, which allows local users to cause a denial of service updatedb exit and incomplete slocate database via a certain crafted directory structure...

security flaw

slocate before 2.7 does not properly process very long paths, which allows local users to cause a denial of service updatedb exit and incomplete slocate database via a certain crafted directory structure...

CVE-2005-2499

slocate before 2.7 does not properly process very long paths, which allows local users to cause a denial of service updatedb exit and incomplete slocate database via a certain crafted directory structure...