SUSE-SU-2021:1165-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2020-27618: Accept redundant shift sequences in IBM1364 bsc1178386 - CVE-2020-29562: Fix incorrect UCS4 inner loop bounds bsc1179694 - CVE-2020-29573: Harden printf against non-normal long double values bsc1179721 - Check vector support in...

printf vulnerable to Regular Expression Denial of Service (ReDoS)

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string regex /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

1ib (>=1.0.9, <=1.0.11), 4front-cli (>=0.0.1, <=0.0.20) +375 more potentially affected by CVE-2021-23354 via printf (>=0.0.4, <=0.6.0)

printf NPM version =0.0.4, =1.0.9, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.5, =1.3.0-beta.0, =1.2.26, =1.2.31, =7.54.0 and more Source cves: CVE-2021-23354 Source advisory: OSV:GHSA-XFHP-GMH8-R8V2...

GHSA-XFHP-GMH8-R8V2 printf vulnerable to Regular Expression Denial of Service (ReDoS)

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string regex /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

CVE-2021-23354

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

CVE-2021-23354

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

Design/Logic Flaw

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

CVE-2021-23354

CVE-2021-23354 affects the Node.js printf package prior to 0.6.1. A vulnerable regex in lib/printf.js can cause a Regular Expression Denial of Service (ReDoS) with cubic worst-case time complexity. Exposure is tied to the printf implementation, not a broader platform. To remediate, upgrade to 0.6...

CVE-2021-23354

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

PT-2021-15456 · Printf · Printf

Name of the Vulnerable Software and Affected Versions: printf versions prior to 0.6.1 Description: The issue concerns a Regular Expression Denial of Service ReDoS vulnerability via a regex string in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity, which can b...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2021-1600)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-23354: Inefficient Regular Expression Complexity

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

Worms David node-printf 安全漏洞

Worms David node-printf is an open source application by Worms David. A fully implemented printfC function family for Node.js, written in pure JavaScript. A security vulnerability exists in node-printf before 0.6.1, which stems from vulnerability to regular expression denial of service ReDoS...

SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2021:0653-1)

This update for glibc fixes the following issues : Fix buffer overrun in EUC-KR conversion module CVE-2019-25013, bsc1182117, BZ 24973 x86: Harden printf against non-normal long double values CVE-2020-29573, bsc1179721, BZ 26649 gconv: Fix assertion failure in ISO-2022-JP-3 module CVE-2021-3326,...

Security update for glibc (important)

openSUSE Security Update: Security update for glibc Announcement ID: openSUSE-SU-2021:0358-1 Rating: important References: 1178386 1179694 1179721 1180038 1181505 1182117 Cross-References: CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2020-29573 CVE-2021-3326 CVSS scores: CVE-2019-25013 NVD :...

OPENSUSE-SU-2021:0358-1 Security update for glibc

This update for glibc fixes the following issues: - Fix buffer overrun in EUC-KR conversion module CVE-2019-25013, bsc1182117, BZ 24973 - x86: Harden printf against non-normal long double values CVE-2020-29573, bsc1179721, BZ 26649 - gconv: Fix assertion failure in ISO-2022-JP-3 module...

Regular Expression Denial of Service (ReDoS)

Overview printf is a complete implementation of the printf C functions family for Node.JS, written in pure JavaScript. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0...

1ib (>=1.0.9, <=1.0.11), 4front-cli (>=0.0.1, <=0.0.20) +375 more potentially affected by CVE-2021-23354 via printf (>=0.0.4, <=0.6.0)

printf NPM version =0.0.4, =1.0.9, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.5, =1.3.0-beta.0, =1.2.26, =1.2.31, =7.54.0 and more Source cves: CVE-2021-23354 Source advisory: SNYK:JS-PRINTF-1072096...

Denial Of Service (DoS)

glibc is vulnerable to denial of service DoS. The vulnerability exists through sysdeps/i386/ldbl2mpn.c where a stack-based buffer overflow occurs on the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a...

glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern

A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflo...