Important: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 Patch 1 release and security update

A patch is now available for Camel for Spring Boot 3.14.5. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS bas...

Wireshark 安全漏洞

Wireshark formerly Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in Wireshark versions 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10, which...

GHSA-3MQ5-FQ9H-GJ7J Duplicate Advisory: Denial of Service due to parser crash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8cc-g7j8-xxpm. This link is maintained to preserve external references. Original Description Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running...

UBUNTU-CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

PT-2022-25251 · Xstream · Xstream

Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified Description: The issue allows for Denial of Service attacks when the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, supporting...

XStream 缓冲区错误漏洞

XStream is a lightweight, easy-to-use, open source Java class library from the XStream team that is primarily used to serialize or deserialize objects into XML JSON. XStream suffers from a buffer error vulnerability that stems from the fact that when a user uses it to serialize XML data, if the...

PT-2022-25248 · Xstream · Xstream

Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified Description: The issue allows for Denial of Service attacks when the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, supporting...

CVE-2022-38750

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow...

UBUNTU-CVE-2022-38750

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow...

PT-2022-6917 · Snakeyaml +3 · Snakeyaml +3

Name of the Vulnerable Software and Affected Versions: snakeYAML affected versions not specified Description: The issue is related to the parsing of untrusted YAML files, which may lead to Denial of Service attacks. If the parser is running on user-supplied input, an attacker may supply content...

mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations

MariaDB through 10.5.9 allows a sqlparse.cc application crash because of incorrect usedtables expectations...

GHSA-WM7H-9275-46V2 Crash in HeaderParser in dicer

This affects all versions of the package dicer. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop...

PT-2022-7239 · Jxpath · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue is related to a buffer overflow in the JXPath library, which can be exploited by a remote attacker to cause a denial of service. If the parser is running on user-supplied input, an...

CVE-2021-45846

A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker to cause an application crash using a crafted AMF document, where a metadata tag lacks a "type" attribute...

DEBIAN-CVE-2021-4183

Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file...

Wireshark 缓冲区错误漏洞

Wireshark formerly Ethereal is a set of network packet analysis software from the Wireshark team. Wireshark versions 3.6.0 and 3.4.0 - 3.4.10 contain an injection vulnerability that stems from a crash in the Sysdig event parser. An attacker could exploit this vulnerability to cause a denial of...

Wireshark 代码问题漏洞

Wireshark formerly known as Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. An injection vulnerability exists in Wireshark versions 3.4.0 - 3.4.10, which stems fro...

OPENSUSE-SU-2021:0555-1 Security update for clamav

This update for clamav fixes the following issues: - CVE-2021-1252: Fix for Excel XLM parser infinite loop. bsc1184532 - CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. bsc1184533 - CVE-2021-1405: Fix for mail parser NULL-dereference crash. bsc1184534 - Fix errors when scannin...

SUSE SLES12 Security Update : clamav (SUSE-SU-2021:1189-1)

This update for clamav fixes the following issues : CVE-2021-1252: Fix for Excel XLM parser infinite loop. bsc1184532 CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. bsc1184533 CVE-2021-1405: Fix for mail parser NULL-dereference crash. bsc1184534 Fix errors when scanning files...

SUSE-SU-2021:1189-1 Security update for clamav

This update for clamav fixes the following issues: - CVE-2021-1252: Fix for Excel XLM parser infinite loop. bsc1184532 - CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. bsc1184533 - CVE-2021-1405: Fix for mail parser NULL-dereference crash. bsc1184534 - Fix errors when scannin...