Amazon Linux 2 : gsl (ALAS-2025-2758)

The version of gsl installed on the remote host is prior to 1.15-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2758 advisory. GSL GNU Scientific Library through 2.8 has an integer signedness error in gslsimansolvemany in siman/siman.c. When params.ntries is...

Amazon Linux 2023 : gsl, gsl-devel (ALAS2023-2025-853)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-853 advisory. GSL GNU Scientific Library through 2.8 has an integer signedness error in gslsimansolvemany in siman/siman.c. When params.ntries is negative, incorrect memory allocation occurs. CVE-2024-50610 Tenable h...

Low: gsl

Issue Overview: GSL GNU Scientific Library through 2.8 has an integer signedness error in gslsimansolvemany in siman/siman.c. When params.ntries is negative, incorrect memory allocation occurs. CVE-2024-50610 Affected Packages: gsl Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

K000149929: tcpdump vulnerability CVE-2020-8037

Security Advisory Description The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. CVE-2020-8037 Impact This flaw allows a remote attacker to send specially crafted packets that, when printed, can lead the application to allocate a large amount of memory,...

F5 Networks BIG-IP : tcpdump vulnerability (K000149929)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000149929 advisory. The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.CVE-2020-8037 Tenable h...

[SECURITY] [DLA 4064-1] libxml2 security update

Debian LTS Advisory DLA-4064-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost February 22, 2025 https://wiki.debian.org/LTS Package : libxml2 Version : 2.9.10+dfsg-6.7+deb11u6 CVE ID : CVE-2022-49043 CVE-2023-39615 CVE-2023-45322 CVE-2024-25062 CVE-2024-56171...

CVE-2025-1470

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-1470 Eclipse OMR: Null pointer dereference vulnerability

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-1470 Eclipse OMR: Null pointer dereference vulnerability

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-1470 Eclipse OMR: Null pointer dereference vulnerability

In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning i...

CVE-2025-1470

CVE-2025-1470 affects Eclipse OMR: prior to version 0.5.0, internal OMR port library and z/OS atoe function consumers did not properly check NULL pointers or allocation failures, risking NULL pointer dereferences. Beginning with 0.5.0, OMR consumers handle NULL return values and memory allocation...

Eclipse OMR security vulnerabilities

Eclipse OMR is an open source toolkit from the Eclipse Foundation for building language runtime environments. A security vulnerability exists in Eclipse OMR that stems from the fact that some OMR internal port library and utility consumers do not check the return value of a null memory pointer or...

Low: gsl

Issue Overview: GSL GNU Scientific Library through 2.8 has an integer signedness error in gslsimansolvemany in siman/siman.c. When params.ntries is negative, incorrect memory allocation occurs. CVE-2024-50610 Affected Packages: gsl Issue Correction: Run dnf update gsl --releasever 2023.6.20250218...

Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

CVE-2025-26618

A flaw was found in the Erlang OTP library. When multiple SSH packets are received, they may be combined into a single SFTP packet that exceeds the maximum allowed size. This flaw allows an authenticated remote attacker to trigger excessive memory allocation and cause a denial of service...

CVE-2025-26618

CVE-2025-26618 is an Erlang/OTP vulnerability where SSH/SFTP packet handling can lead to excessive memory allocation. The issue occurs after SSH handshake for authenticated users and is fixed in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. Connected advisories reiter the memory impact and patch ...

CVE-2025-26618 SSH SFTP packet size not verified properly in Erlang OTP

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet si...

CVE-2025-26618

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet si...

CVE-2025-26618 SSH SFTP packet size not verified properly in Erlang OTP

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet si...

CVE-2025-26618 SSH SFTP packet size not verified properly in Erlang OTP

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet si...