EulerOS 2.0 SP8 : curl (EulerOS-SA-2023-1590)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the 'chained' HTTP compression algorithms,...

Oracle Linux 9 : curl (ELSA-2023-1701)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-1701 advisory. 7.76.1-19.el91.2 - fix HTTP multi-header compression denial of service CVE-2023-23916 Tenable has extracted the preceding description block directly from the...

PT-2023-36757

Уязвимость функции hi846 init controls модуля drivers/media/i2c/hi846.c драйвера мультимедийных устройств ядра операционной системы Linux связана с распределением ресурсов без ограничений и регулирования. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Siemens SCALANCE XCM332 Allocation of Resources Without Limits or Throttling (CVE-2022-32206)

curl 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable links in this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited...

Siemens SCALANCE XCM332 Allocation of Resources Without Limits or Throttling (CVE-2022-32205)

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl 7.84.0 stores all of them. A sufficiently large amount of big cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger th...

Exploit for Allocation of Resources Without Limits or Throttling in Apache Commons_Fileupload

This is a proof-of-concept PoC exploit for CVE-2023-24998, a v...

Advisory ROSA-SA-2023-2136

Software: java-11-openjdk 11.0.18.0.10-1 OS: rosa-server79 packageevrstring: 11.0.18.0.10-1 CVE-ID: CVE-2022-21365 BDU-ID: 2022-02011 CVE-Crit: MEDIUM CVE-DESC: A vulnerability in the ImageIO component of the Oracle Java SE software platform and Oracle GraalVM Enterprise Edition virtual machine i...

PT-2023-36768

Уязвимость функции exynos generic icc probe модуля drivers/interconnect/samsung/exynos.c драйвера межсоединений ядра операционной системы Linux связана с распределением ресурсов без ограничений и регулирования. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

PT-2023-36724

Уязвимость функции do feature check call модуля drivers/firmware/xilinx/zynqmp.c драйвера прошивок ядра операционной системы Linux связана с распределением ресурсов без ограничений и регулирования. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

RHEL 8 : curl (RHSA-2023:1140)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1140 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

Rocky Linux 8 : curl (RLSA-2023:1140)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:1140 advisory. - An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the chained HTTP compression algorithms, meaning that a...

PT-2023-36740

Уязвимость функции icc node destroy модуля drivers/interconnect/core.c драйвера межсоединений ядра операционной системы Linux связана с распределением ресурсов без ограничений и регулирования. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

PT-2023-4306 · Ibm · Ibm Watson Cp4D Data Stores

Name of the Vulnerable Software and Affected Versions: IBM Watson CP4D Data Stores version 4.6.0 Description: The issue is related to the improper allocation of resources without limits or throttling in the data storage of IBM Cloud Pak for Data CP4D. This could allow a remote attacker with...

Fedora 36 : curl (2023-94df30cbec)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-94df30cbec advisory. - fix HTTP multi-header compression denial of service CVE-2023-23916 Tenable has extracted the preceding description block directly from the Fedora security...

Debian dla-3341 : curl - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3341 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3341-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-23916

An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...

Design/Logic Flaw

An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...

curl 安全漏洞

curl is a tool for transferring data from or to a server. A security vulnerability exists in curl versions prior to v7.88.0 that stems from the presence of an unrestricted or throttled resource allocation vulnerability...

CVE-2023-23916

An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...

CVE-2023-23916

CVE-2023-23916 involves curl before 7.88.0 where an attacker could abuse the chained HTTP compression chain to create a degenerate decompression path. Although the cap on the number of links is per header, a malicious server can inject many headers to form an effectively unlimited decompression c...