PT-2014-4899

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.4 Lightwitch Metronome versions prior to 3.5 Description The issue allows remote attackers to cause a denial of service due to resource consumption via compressed XML elements in an XMPP stream. This type of attac...

Prosody XML解压缩拒绝服务漏洞

CVE ID:CVE-2014-2744、CVE-2014-2745 Prosody是一个用Lua语言编写的Jabber/XMPP服务器软件。 Prosody处理压缩流存在错误，允许攻击者通过XMPP流提交特制的XML消耗系统资源，造成拒绝服务攻击。 0 Prosody 0.x Prosody 0.9.4版本已修复该漏洞，建议用户下载使用： http://www.prosody.im...

Debian DSA-2895-1 : prosody - security update

A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as 'zip bomb' over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected b...

Debian Security Advisory DSA 2895-1 (prosody - security update)

A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as zip bomb over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected by...

DSA-2895-1 prosody - security update

Bulletin has no description...

[SECURITY] [DSA 2895-1] prosody security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2895-1 [email protected] http://www.debian.org/security/ Luciano Bello April 06, 2014 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-2895-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

DEBIAN-CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

DEBIAN-CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

Code injection

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

Design/Logic Flaw

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...