SUSE-SU-2022:3875-1 Security update for xmlbeans

This update for xmlbeans fixes the following issues: - CVE-2021-23926: Fixed XML parsers not protecting from malicious XML input bsc1180915...

Denial Of Service (DoS)

libtasn1.so is vulnerable to Denial Of Service DoS. The vulnerability exists in struct tagandclassst function of init.h due to an ETYPEOK off-by-one array size check which allows an attacker to crash the application via malicious input...

Denial Of Service (DoS)

muhammara is vulnerable to denial of service. The vulnerability exists in multiple functions of ObjectByteWriterWithPosition.cpp when PDFStreamForResponse is used with invalid data which allows an attacker to crash the application via malicious input...

RUSTSEC-2022-0079 ELF header parsing library doesn't check for valid offset

The crate has several unsafe sections that don't perform proper pointer validation. An example can be found in the following function: fn sectionheaderraw&self - &ET::SectionHeader let shoff = self.elfheader.sectionheaderoffset as usize; let shnum = self.elfheader.sectionheaderentrynum as usize;...

Buffer Overflow

libexiv2.so is vulnerable to buffer overflow. The vulnerability exists when datasize is less than headersize in the WebPImage::getHeaderOffset function of webpimage.cpp, allowing an attacker to cause an application crash through the integer overflow by providing a malicious input...

Denial Of Service (DoS)

vim is vulnerable to denial of service. The vulnerability exists due to the use after free in the qfupdatebuffer function of quickfix.c, allowing an attacker to cause an application crash through malicious input...

httpd: Out-of-bounds write in ap_escape_quotes() via malicious input

An out-of-bounds write in function apescapequotes of httpd allows an unauthenticated remote attacker to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing malicious input to the function...

CVE-2022-38162

Reflected cross-site scripting XSS vulnerabilities in WithSecure through 2022-08-10 exists within the F-Secure Policy Manager due to an unvalidated parameter in the endpoint, which allows remote attackers to provide a malicious input...

Cross site scripting

Reflected cross-site scripting XSS vulnerabilities in WithSecure through 2022-08-10 exists within the F-Secure Policy Manager due to an unvalidated parameter in the endpoint, which allows remote attackers to provide a malicious input...

CVE-2022-38162

Reflected cross-site scripting XSS vulnerabilities in WithSecure through 2022-08-10 exists within the F-Secure Policy Manager due to an unvalidated parameter in the endpoint, which allows remote attackers to provide a malicious input...

Privilege Escalation

chromium is vulnerable to privilege escalation. The vulnerability exists due to type confusion in Blink which allows an attacker to inject malicious input...

Remote Code Execution (RCE)

chromium is vulnerable to remote code execution. The vulnerability exists due to insufficient validation of untrusted input in VPN, allowing an attacker to crash the application by providing a malicious input...

Denial Of Service (DoS)

libdhcp.so is vulnerable to Denial Of Service DoS. The vulnerability exists when the function optioncodehashlookup is called from addoption in option.c due to the option's refcount field which allows an attacker to crash the application via malicious input...

Denial Of Service (DoS)

dbus is vulnerable to Denial Of Service DoS.The vulnerability exists due to a message with certain invalid type signatures which allows an attacker to crash the application via malicious input...

The vulnerability of the HNAP1 protocol implementation in the microprogramming-based router software of D–Link DIR-823G allows a attacker to execute arbitrary commands.

The vulnerability of the HNAP1 protocol implementation in the microprogramming-based router software of D–Link DIR-823G is related to insufficient checking of arguments transmitted in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by entering...

Denial Of Service (DoS)

firefox is vulnerable to denial of service. The vulnerability exists due to data cache when creating wasm code which allows an attacker to cause an application crash via a malicious input...

Buffer Overflow

vim is vulnerable to buffer overflow. The vulnerability exists because the illegal memory access when replacing in virtualedit mode which allows an attacker to crash the application via malicious input...

Denial Of Service (DoS)

vim is vulnerable to denial of service. The vulnerability exists in getcmdlineint function of exgetln.c due to use after free which allows an attacker to crash the application via malicious input...

Denial Of Service (DoS)

tcpreplay is vulnerable to denial of service. The vulnerability exists in packet2tree function of tree.c due to a reachable assertion which allows an attacker to crash the application via malicious input...

HTTP Request Smuggling

nodejs-current is vulnerable to HTTP request smuggling. The vulnerability exists due to incorrect parsing header fields in the library, allowing an attacker to smuggle HTTP requests by providing a maliciously crafted input...