CVE-2010-1158

CVE-2010-1158 : Integer overflow in the Perl 5.8.x regular expression engine can allow a context‑dependent attacker to cause a denial of service (stack consumption and application crash) by matching a crafted regex against a long string. The available documents state the vulnerability but do not ...

ViewVC < 1.0.11 / 1.1.5 Regex Search Cross-Site Scripting Vulnerability

Binary data 5501.prm...

DEBIAN-CVE-2009-3626

Perl 5.10.1 allows context-dependent attackers to cause a denial of service application crash via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match...

Perl UTF-8规则表达式处理远程拒绝服务漏洞

Bugraq ID: 36812 CVE ID： CVE-2009-3626 Perl是一款流行的网络编程语言。 Perl在处理包含在规则表达式中使用UTF-8字符的字符串时存在错误，远程攻击者可以利用漏洞使解释器崩溃。 提交包含大量非法的UTF-8字符的邮件消息，给使用Perl的应用程序解析，可导致解析器崩溃。 Larry Wall Perl 5.10.1 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 厂商解决方案 GIT库已经修正此漏洞，建议用户下载使用：...

CVE-2009-3695

This CVE covers the Django forms library vulnerability where the regex used to validate EmailField and URLField can backtrack excessively, causing high CPU and potential denial of service. Affected versions are Django 1.0 before 1.0.4 and 1.1 before 1.1.1. The issue stems from algorithmic complex...

openSUSE 10 Security Update : ruby (ruby-6339)

This ruby update improves return value checks for openssl function OCSPbasicverify CVE-2009-0642 which allowed an attacker to use revoked certificates. The entropy of DNS identifiers was increased CVE-2008-3905 to avaid spoofing attacks. The code for parsing XML data was vulnerable to a denial of...

SuSE9 Security Update : ruby (YOU Patch Number 12452)

This update for ruby fixes the following security issues : - Improve return value checks for OpenSSL function OCSPbasicverify to refuse usage of revoked certificates. CVE-2009-0642 - Increase entropy of DNS identifiers to avoid spoofing attacks. CVE-2008-3905 - Fix denial of service DoS...

nss regexp heap overflow

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL servers to cause a denial of service application crash or possibly...

nss regexp heap overflow

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL servers to cause a denial of service application crash or possibly...

nss regexp heap overflow

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL servers to cause a denial of service application crash or possibly...

PHP Evaluation Replacement String

mberegireplace evaluate replacement string vulnerability by ryatwww.80vul.com when option parameter set e, matchs not be escaped. ex: phpinfo will be evaluated. mberegreplace if replacelen - i = 2 && fwd == 1 && p0 == '\' && p1 = '0' && p1 = 0 && n numregs if regs-begn = 0 && regs-begn endn &&...

Design/Logic Flaw

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit JDK before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to...

CVE-2009-1190

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit JDK before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to...

Mandriva Update for perl MDVSA-2008:100 (perl)

Check for the Version of perl OpenVAS Vulnerability Test Mandriva Update for perl MDVSA-2008:100 perl Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CentOS Update for perl CESA-2008:0522 centos3 i386

Check for the Version of perl OpenVAS Vulnerability Test CentOS Update for perl CESA-2008:0522 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Forgot Password/Crowd Integration exception handling and regex improvements

If JIRA is integrated with Crowd, and Crowd has password restrictions e.g. regex, a user will receive a stack trace in JIRA if the new password does not meet Crowd's password requirements e.g. through the Forgot Password link in JIRA. noformat java.lang.IllegalArgumentException: Could not change...

Forgot Password/Crowd Integration exception handling and regex improvements

If JIRA is integrated with Crowd, and Crowd has password restrictions e.g. regex, a user will receive a stack trace in JIRA if the new password does not meet Crowd's password requirements e.g. through the Forgot Password link in JIRA. noformat java.lang.IllegalArgumentException: Could not change...

USN-700-2: Perl regression

USN-700-1 fixed vulnerabilities in Perl. Due to problems with the Ubuntu 8.04 build, some Perl .ph files were missing from the resulting update. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jonathan Smith discovered that the Archive::Tar Perl modul...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service CPU consumption via a crafted HTTP request...

ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS)

The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop and crash via multiple long requests to a Ruby socket, related to memory allocation failure...