ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS)

The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop and crash via multiple long requests to a Ruby socket, related to memory allocation failure...

ruby: WEBrick DoS vulnerability (CPU consumption)

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.splitheadervalue function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of...

CVE-2008-4557

plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 aka Strawberry allows remote attackers to execute arbitrary PHP code via the text parameter, which is inserted into an executable regular expression...

Server: temporary DoS via crafted pattern searches

Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service CPU consumption and search outage via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem...

Resource Management Errors

Overview Affected versions of this package are vulnerable to Resource Management Errors. The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop an...

CVE-2008-3443

The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop and crash via multiple long requests to a Ruby socket, related to memory allocation failure...

CVE-2008-3443

The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop and crash via multiple long requests to a Ruby socket, related to memory allocation failure...

Ruby Memory allocation failure in Ruby regex engine (remotely exploitable DoS)

The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop and crash via multiple long requests to a Ruby socket, related to memory allocation failure...

Ruby 1.9 - regex engine Remote Socket Memory Leak

Ruby 1.9 - regex engine Remote Socket Memory Leak ------------------------------------------------------- Language : Ruby Web Site: www.ruby-lang.org Platform: All Bug: Remote Socket Memory Leak Products Affected: 1.8 series: - 1.8.5 and all prior versions - 1.8.6-p286 and all prior versions -...

Ruby <= 1.9 (regex engine) Remote Socket Memory Leak Exploit

Exploit for multiple platform in category dos / poc ============================================================ Ruby = 1.9 regex engine Remote Socket Memory Leak Exploit ============================================================ ------------------------------------------------------- Language ...

DEBIAN-CVE-2008-2371

Heap-based buffer overflow in pcrecompile.c in the Perl-Compatible Regular Expression PCRE library 7.7 allows context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches...

mod_perl PerlRun denial of service

PerlRun.pm in Apache modperl before 1.30, and RegistryCooker.pm in modperl 2.x, does not properly escape PATHINFO before use in a regular expression, which allows remote attackers to cause a denial of service resource consumption via a crafted URI...

Server: insufficient buffer size for search patterns

Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service slapd crash and possibly execute arbitrary code via a crafted LDAP query that triggers the overflow during translation to a regular expression...

Server: insufficient buffer size for search patterns

Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service slapd crash and possibly execute arbitrary code via a crafted LDAP query that triggers the overflow during translation to a regular expression...

openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-5053)

This update of OpenOffice fixes various critical security vulnerabilities - heap-overflow when parsing PPT files CVE-2008-0320 - various buffer-overflows while parsing QPRO files CVE-2007-5745, CVE-2007-5747 - out-of-bound memory access and a heap-overflow in the regex engine of libICU...

Debian Security Advisory DSA 1520-1 (smarty)

The remote host is missing an update to smarty announced via advisory DSA 1520-1. OpenVAS Vulnerability Test $Id: deb15201.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1520-1 smarty Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian DSA-1520-1 : smarty - insufficient input sanitising

It was discovered that the regex module in Smarty, a PHP templating engine, allows attackers to call arbitrary PHP functions via templates using the regexreplace plugin by a specially crafted search string. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

[SECURITY] [DSA 1520-1] New smarty packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1520-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 16, 2008 http://www.debian.org/security/faq -...

zkup-upload.txt

!/usr/bin/php Date: 03-08-2008 Conditions: PHP Version, magicquotesgpc=Off This exploit spawn a php uploader in your victim's server. Okay, you may need explanations: First, we can use administration without being admin see ./admin/configuration/modifier.php Then, when we add an admin, it is save...

postgresql DoS via infinite loop in regex NFA optimization code

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service infinite loop via a crafted regular expression...