Medium: perl

Issue Overview: A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a heap allocated buffer. CVE-2023-47038 In Perl before 5.38.2, Sparseunipropstring in regcomp.c can write to unallocated space because a property na...

Vulnerabilities fixed in IBM DB2

IBM has fixed vulnerabilities in DB2. A malicious party could exploit the exploit the vulnerabilities to grant himself elevated privileges, or to cause a denial-of-service by executing a specially prepared query. These updates also include several updates to third-party products to include older...

OESA-2023-1863 perl security update

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: A vulnerability was found in perl. This...

OESA-2023-1864 perl security update

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: A vulnerability was found in perl. This...

Heap-based Buffer Overflow

perl is vulnerable to Heap-based Buffer Overflow. The vulnerability is caused due to a crafted regular expression compiled by Perl which can lead to an attacker controlled byte buffer to overflow...

PT-2023-9165

Name of the Vulnerable Software and Affected Versions angular versions 1.3.0 and later Description A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic...

USN-6517-1 perl vulnerabilities

It was discovered that Perl incorrectly handled printing certain warning messages. An attacker could possibly use this issue to cause Perl to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2022-48522 Nathan Mills discovered that Perl incorrectly...

UBUNTU-CVE-2023-47038

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer...

CVE-2023-46402

A flaw was found in the git-urls package. This issue occurs when a long input is provided inside the directory path of the git url. This could lead to loading delays or a regular expression denial of service...

CLSA-2023-1699908687 exim: Fix of CVE-2022-3559

CVE-2022-3559: Fix $regex use-after-free...

CLSA-2023-1699908139 exim: Fix of CVE-2022-3559

CVE-2022-3559: Fix $regex use-after-free...

python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

A regular expression denial of service vulnerability has been found in Django. Email and URL validators are vulnerable to this flaw when processing a very large number of domain name labels of emails and URLs...

Security Bulletin: A vulnerability in Node.js http-cache-semantics package affects Data Replication on Cloud Pak for Data

Summary A vulnerability in Node.js http-cache-semantics package used in Data Replication on Cloud Pak for Data was addressed. Vulnerability Details CVEID:CVE-2022-25881 DESCRIPTION: Node.js http-cache-semantics module is vulnerable to a denial of service, caused by a regular expression denial of...

Rocky Linux 9 : go-toolset and golang (RLSA-2023:0328)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0328 advisory. - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of...

CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-3909

GitLab CE/EE is affected by CVE-2023-3909: A Regular Expression Denial of Service can be triggered by a very large string in timeout input within gitlab-ci.yml. Affected versions are: all 12.3–16.3.5, all 16.4.x before 16.4.2, and all 16.5.x before 16.5.1. Root cause stated is inefficient regex h...

CVE-2023-5876 Regex DoS from a malicious server enrolled in Desktop

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from US-based Mattermost. A security vulnerability exists in Mattermost version 5.5.0 and prior versions, which stems from an inability to properly validate a regular expression constructed based on the path to a server URL, resulting in a denia...

Security Bulletin: IBM Storage Ceph is vulnerable to a REDOS attack in MarkedJS (CVE-2022-21680, CVE-2022-21681)

Summary MarkedJS is used by IBM Storage Ceph as a compiler to parse markdown. CVE-2022-21680, CVE-2022-21681 Vulnerability Details CVEID: CVE-2022-21680 DESCRIPTION: Node.js marked module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in block.de...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from a regular expression...