GO-2023-1534 Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

Unmarshalling a Hello Verify request can panic, which could allow a denial of service...

PT-2023-35369 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.304 Description: The issue is related to the f2fs extent tree. If the extent tree is not created, it may cause a panic. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2023-35188 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue is related to the f2fs component, where a panic can be avoided if the extent tree is not created. The actual impact and attack plausibility have not yet been proven...

PT-2023-34952 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.11 Description: The issue is related to a kernel panic when probing an illegal position in the RISC-V architecture. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

IPFS go-bitfield vulnerable to DoS via malformed size arguments

Impact When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8 or is negative. There were already a note in the NewBitfield documentation: Panics if size is not a multiple ...

CVE-2022-2879

A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory,...

CVE-2023-23625

go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout paramete...

Code injection

go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8...

CVE-2023-23626 Denial of service when feeding malformed size arguments in go-bitfield

go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8...

CVE-2023-23626 Denial of service when feeding malformed size arguments in go-bitfield

go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8...

go-unixfs 资源管理错误漏洞

go-unixfs is an implementation of a unix-like filesystem utility on top of ipld merkledag. A resource management error vulnerability exists in go-unixfs versions prior to 0.4.3, which stems from an attempt to read an incorrectly formatted HAMT slice directory that could lead to panic and virtual...

go-bitfield 代码问题漏洞

go-bitfield is a simple bitfield package from IPFS Open Source. A code issue vulnerability exists in versions prior to go-bitfield v1.1.0 that stems from an attacker being able to trigger a panic when entering untrusted users into the parameters of the NewBitfield and FromBytes functions...

PT-2023-19092 · Unknown · Go-Unixfsnode

Name of the Vulnerable Software and Affected Versions: go-unixfsnode versions prior to 1.5.2 Description: The issue is caused by a bogus fanout parameter in the HAMT directory nodes, which can lead to panics and virtual memory leaks when trying to read malformed HAMT sharded directories. If...

GHSA-9XM8-8QVC-VW3P Denial of Service in dhowden/tag

dhowden tag before 0.0.0-20201120070457-d52dcb253c63 allows panic: runtime error: index out of range via readPICFrame...

GHSA-4XGV-J62Q-H3RJ Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

Impact During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. Workaround None, upgrade to 2.2.4...

Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

Impact During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. Workaround None, upgrade to 2.2.4...

Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

Impact When attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. Workaround None...

GHSA-HXP2-XQF3-V83H Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

Impact When attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. Workaround None...

SUSE-SU-2023:0281-1 Security update for the Linux Kernel (Live Patch 17 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005963 fixes several issues. The following security issues were fixed: - CVE-2022-3424: Fixed use-after-free in grusetcontextoption, grufault and gruhandleusercallos that could lead to kernel panic bsc1204167. - CVE-2022-2602: Fixed a local privilege...

SUSE-SU-2023:0277-1 Security update for the Linux Kernel (Live Patch 1 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002411 fixes several issues. The following security issues were fixed: - CVE-2022-4379: A use-after-free vulnerability was found in nfs42sscopen in fs/nfs/nfs4file.c in the Linux kernel. This flaw allowed an attacker to conduct a remote denial of servi...