11226 matches found
CVE-2023-42447 blurhash panics on parsing crafted inputs
blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on...
CVE-2023-42444 phonenumber panics on parsing crafted RF3966 inputs
phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions 0.3.3+8.13.9 and 0.2.5+8.11.3, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber,...
phonenumber: panic on parsing crafted RF3966 phonenumber inputs
Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...
RUSTSEC-2023-0083 blurhash: panic on parsing crafted blurhash inputs
Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-...
RUSTSEC-2023-0082 phonenumber: panic on parsing crafted RF3966 phonenumber inputs
Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...
blurhash: panic on parsing crafted blurhash inputs
Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-...
blurhash-rs security vulnerability
blurhash-rs is a pure Rust implementation of Blurhash. A security vulnerability exists in blurhash-rs version 0.1.1, which stems from an out-of-bounds access when guarding multiple times against untrusted inputs, and may cause a panic in the blurhash parsing code...
Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6388-1)
The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6388-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions...
Improper Validation of Array Index
Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are...
PT-2023-9747 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the BPF Berkeley Packet Filter program in the Linux kernel. When the bpf throw kfunc is called, it triggers dead code elimination in an unprecedented way, causi...
HPACK decoder panics on invalid input
Due to insufficient checking of input data, decoding certain data sequences can lead to Decoder::decode panicking rather than returning an error. Example code that triggers this vulnerability looks like this: rust use hpack::Decoder; pub fn main let input = &0x3f; let mut decoder = Decoder::new;...
Golang < 1.20.8 / 1.21.x < 1.21.1 Multiple Vulnerabilities
The version of Golang Go installed on the remote host is affected by multiple vulnerabilities, including the following: - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory...
RUSTSEC-2023-0062 BER/CER/DER decoder panics on invalid input
Due to insufficient checking of input data, decoding certain data sequences can lead to bcder panicking rather than returning an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. bcder 0.7.3 fixes these issues by more...
CVE-2023-39321
A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic...
PT-2023-9742 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the version that includes the fix for the f2fs reference count leak Description: The issue is related to a reference count leak in the f2fs component of the Linux kernel. During the f2fs put super function, a...
Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6339-3)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6339-3 advisory. It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An...
CVE-2023-39321
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
CVE-2023-39321
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...