314 matches found
SUSE-SU-2025:01945-1 Security update for kubernetes-old
This update for kubernetes-old fixes the following issues: - CVE-2025-22872: Fixed golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction bsc1241781 This update to version 1.31.9 jscPED-11105 Find full changelog...
SUSE CVE-2025-47183
In GStreamer through 1.26.1, the isomp4 plugin's qtdemuxparsetree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure...
CLSA-2025-1749569869 libsoup: Fix of 3 CVEs
CVE-2025-46420: fix memory leaks in the soupheaderparsequalitylist - CVE-2025-32050: fix using int instead of sizet for strcspn return to avoid buffer under-read - CVE-2025-32052: fix heap buffer overflow in soupcontentsniffersniff...
CVE-2022-39202
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat IRC protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such...
CLSA-2025-1747855403 squid: Fix of 6 CVEs
CVE-2021-28651: fix memory leak in RFC 2169 response parsing - CVE-2021-28652: fix broken cache manager URL parsing - CVE-2021-31806: fix memory management bug - CVE-2021-31807: fix integer overflow problem - CVE-2021-31808: fix input validation bug - CVE-2021-33620: handle more partial responses...
AZL-60492 CVE-2025-22872 affecting package ig for versions less than 0.37.0-4
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
Security update for etcd
This update for etcd fixes the following issues: Update to version 3.5.21: CVE-2025-30204: Fixed a bug that could allow excessive memory allocation during header parsing in jwt-go. bsc1240515 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
CVE-2024-20877
Heap out-of-bound write vulnerability in parsing grid image header in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to execute arbitrary code...
Mobile Security Framework 安全漏洞
Mobile Security Framework MobSF is an automated all-in-one mobile application open-sourced by Mobile Security Framework. It is used for penetration testing, malware analysis, and security assessments, and is capable of performing both static and dynamic analysis. A security vulnerability exists i...
Qualcomm Chipsets 安全漏洞
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption that occurs when parsing memory mapping information in an IOCTL call...
Medium: runfinch-finch
Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 golang-jwt is a Go implementation of JSON Web Tokens. Unclear...
CVE-2024-6819
IrfanView PSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...
Important: libarchive
Issue Overview: executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. CVE-2024-48957 executefilterdelta in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds...
OESA-2024-2043 python-webob security update
WebOb provides wrappers around the WSGI request environment, and an object to help create WSGI responses. The objects map much of the specified behavior of HTTP, including header parsing and accessors for other standard parts of the environment. Security Fixes: WebOb provides objects for HTTP...
CVE-2024-39312
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtree...
ALPINE-CVE-2024-39312
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtree...
Botan Security Vulnerabilities
Botan is a library of cryptographic algorithms written in C++. It supports a variety of algorithms including AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security vulnerability exists in Botan that stems from an error in the parsing of name-constrained extensions in X.509 certificates, which...
python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...
AZL-42034 CVE-2024-4068 affecting package reaper for versions less than 3.1.1-9
The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating...