Remote Code Execution

nginx is vulnerable to remote code execution. A remote attacker who is able to provide DNS responses to a nginx server can likely achieve remote code execution due to an off-by-one error in ngxresolvercopy while processing DNS responses...

[SECURITY] [DSA 4921-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4921-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 28, 2021 https://www.debian.org/security/faq -...

nginx 1.20.0 DNS Resolver Off-By-One Heap Write Exploit

An off-by-one error in ngxresolvercopy while processing DNS responses allows a network attacker to write a dot character '.', 0x2E out of bounds in a heap allocated buffer. The vulnerability can be triggered by a DNS response in reply to a DNS request from nginx when the resolver primitive is...

Johnson Controls Sensormatic Electronics VideoEdge

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: VideoEdge Vulnerability: Off-by-one Error 2. RISK EVALUATION Under specific circumstances, a local authenticated user may be able to exploit this...

CVE-2021-23017

A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in...

nginx 1.20.0 DNS Resolver Off-By-One Heap Write

Advisory X41-2021-002: nginx DNS Resolver Off-by-One Heap Write Vulnerability ============================================================================= Severity Rating: High Confirmed Affected Versions: 0.6.18 - 1.20.0 Confirmed Patched Versions: 1.21.0, 1.20.1 Vendor: F5, Inc. Vendor URL:...

Nginx < 1.20.1 Off-By-One Heap Write

According to its self-reported version number, the detected version of nginx is prior to 1.20.1. It is, therefore, affected by an off-by-one error in ngxresolvercopy while processing DNS responses. Note that the scanner has not tested for these issues but has instead relied only on the...

GHSA-JFP7-4J67-8R3Q Heap buffer overflow caused by rounding

Impact An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements: python import tensorflow as tf l = 256, 328, 361, 17, 361, 361, 361, 361, 361, 361, 361, 361, 361...

PYSEC-2021-655

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the...

Johnson Controls Sensormatic Tyco AI

1. EXECUTIVE SUMMARY CVSS v3 7.0 Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: Tyco AI Vulnerability: Off-by-one Error 2. RISK EVALUATION Under specific circumstances, a local attacker could use this vulnerability to obtain super-user access to the underlying...

CVE-2021-31875

In mjsjson.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjsjsonparse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t...

PT-2021-19559 · Cesanta · Mongooseos Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MongooseOS mJS version 1.26 Description: A maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs json parse, potentially leading to redirection of control flow. The original reporter disputes the...

Johnson Controls Exacq Technologies exacqVision

1. EXECUTIVE SUMMARY CVSS v3 7.0 Vendor: Exacq Technologies, Inc., a subsidiary of Johnson Controls, Inc. Equipment: exacqVision Vulnerability: Off-by-one Error 2. RISK EVALUATION A local attacker could exploit this vulnerability to obtain “Super User” access to the underlying Ubuntu Linux...

CVE-2021-31875

The CVE concerns Cesanta MongooseOS mJS 1.26, where a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse. This may lead to redirection of control flow. Affected component: mjs_json_parse in mjs_json.c. Documented impact remains high (potential co...

SUSE: Security Advisory (SUSE-SU-2019:0284-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : the Linux Kernel (openSUSE-2021-532)

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading...

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory aka CID-10d2bb2e6b1d.

...

CVE-2020-27171

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error with a resultant integer underflow affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information...

AZL-6526 CVE-2020-27171 affecting package kernel for versions less than 5.10.78.1-1

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error with a resultant integer underflow affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information...

DEBIAN-CVE-2020-27171

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error with a resultant integer underflow affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information...