git-url-parse Regular Expression Denial of Service

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

agogosml-cli (0.1.2), chip-wallet-dstack (>=1.3.0, <=1.5.0) +23 more potentially affected by CVE-2023-32758 via git-url-parse (>=1.0.2, <=1.2.2)

git-url-parse PYPI version =1.0.2, =1.3.0, =1.11.4rc1, =0.3.1.1, =0.5.0, =0.0.4rc12, =0.1.2, =0.1.0, =0.0.1, =0.25.0, =0.3.10, =0.6.8 and more Source cves: CVE-2023-32758 Source advisory: GHSA-4XQQ-73WG-5MJP...

agogosml-cli (0.1.2), chip-wallet-dstack (>=1.3.0, <=1.5.0) +23 more potentially affected by CVE-2023-32758 via git-url-parse (>=1.0.2, <=1.2.2)

git-url-parse PYPI version =1.0.2, =1.3.0, =1.11.4rc1, =0.3.1.1, =0.5.0, =0.0.4rc12, =0.1.2, =0.1.0, =0.0.1, =0.25.0, =0.3.10, =0.6.8 and more Source cves: CVE-2023-32758 Source advisory: OSV:GHSA-4XQQ-73WG-5MJP...

GHSA-4XQQ-73WG-5MJP git-url-parse Regular Expression Denial of Service

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

CVE-2023-32758

The connected documents confirm CVE-2023-32758 affects git-url-parse (Python) up to 1.2.2, used by Semgrep versions 1.5.2–1.24.1. The issue is a Regular Expression Denial of Service (ReDoS) when parsing untrusted URLs, with potential impact if a package’s author embeds a crafted URL in a target p...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : SQL parse vulnerability (USN-6064-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6064-1 advisory. It was discovered that SQL parse incorrectly handled certain regular expression. An attacker could possibly use this issue to caus...

CVE-2023-31913

Jerryscript 3.0 commit 1a2c047 was discovered to contain an Assertion Failure via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

ada-url:parse: Crash in bool ada::url_aggregator::set_host_or_hostname<true>

Detailed Report: https://oss-fuzz.com/testcase?key=5329718332489728 Project: ada-url Fuzzing Engine: centipede Fuzz Target: parse Job Type: centipedeasanada-url Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60b000060000 Crash State: bool ada::urlaggregator::sethostorhostname...

PT-2023-23518

Name of the Vulnerable Software and Affected Versions Jerryscript version 3.0 commit 1a2c047 Description An Assertion Failure was discovered in Jerryscript via the parser parse function arguments at jerry-core/parser/js/js-parser.c. Recommendations For Jerryscript version 3.0 commit 1a2c047,...

PT-2023-23515 · Unknown · Jerryscript

Name of the Vulnerable Software and Affected Versions: Jerryscript version 3.0 commit 1a2c047 Description: An Assertion Failure was discovered in Jerryscript via the component parser parse class at jerry-core/parser/js/js-parser-expr.c. Recommendations: For Jerryscript version 3.0 commit 1a2c047,...

ada-url:parse: Crash in bool ada::url_aggregator::set_host_or_hostname<true>

Project: https://github.com/ada-url/ada.git Detailed Report: https://oss-fuzz.com/testcase?key=5425614048591872 Project: ada-url Fuzzing Engine: libFuzzer Fuzz Target: parse Job Type: libfuzzerubsanada-url Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000002e1e000 Crash State: bool...

USN-6064-1: SQL parse vulnerability

It was discovered that SQL parse incorrectly handled certain regular expression. An attacker could possibly use this issue to cause a denial of service...

JerryScript buffer error vulnerability

JerryScript is a lightweight JavaScript engine from the Jerryscript project. A security vulnerability exists in JerryScript version 3.0.0 1a2c047, which originates in the component parserparsefunctionstatement in /jerry-core/parser/js/js-parser-statm.c contains a heap buffer overflow...

PT-2023-23514

Name of the Vulnerable Software and Affected Versions Jerryscript version 3.0 commit 05dbbd1 Description A heap-buffer-overflow issue was discovered in the parser parse function statement component at /jerry-core/parser/js/js-parser-statm.c. This issue affects the parsing of function statements...

CVE-2023-31910

Jerryscript 3.0 commit 05dbbd1 was discovered to contain a heap-buffer-overflow via the component parserparsefunctionstatement at /jerry-core/parser/js/js-parser-statm.c...

kernel: soc: qcom: ocmem: Fix refcount leak in of_get_ocmem

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: ocmem: Fix refcount leak in ofgetocmem ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak. ofnodeput will...

kernel: usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe

In the Linux kernel, the following vulnerability has been resolved: usb: ohci-nxp: Fix refcount leak in ohcihcdnxpprobe ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

PT-2023-6791

Name of the Vulnerable Software and Affected Versions yajl version 2.1.0 Description The issue is related to a memory leak caused by the use of the yajl tree parse function in the yajl library. This can lead to out-of-memory conditions in servers, resulting in crashes. The vulnerability can be...

DEBIAN-CVE-2022-40318

An issue was discovered in bgpd in FRRouting FRR through 8.4. By crafting a BGP OPEN message with an option of type 0xff Extended Length from RFC 9072, attackers may cause a denial of service assertion failure and daemon restart, or out-of-bounds read. This is possible because of inconsistent...

OESA-2023-1256 protobuf-c security update

This is protobuf-c, a C implementation of the Google Protocol Buffers data serialization format. Security Fixes: protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember.CVE-2022-48468...