Amazon Linux 2022 : expat, expat-devel, expat-static (ALAS2022-2022-036)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-036 advisory. An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This fl...

Important: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update

Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...

RHEL 8 : Red Hat OpenShift Service Mesh 2.1.5 (RHSA-2022:6277)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6277 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.2 Containers security update

Red Hat OpenShift Service Mesh 2.2.2 Containers Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: Self Node Remediation Operator 0.4.1 security update

This is an updated release of the Self Node Remediation Operator. The Self Node Remediation Operator replaces the Poison Pill Operator, and is delivered by Red Hat Workload Availability. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.56 security and bug fix update

Red Hat OpenShift Container Platform release 4.7.56 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

CVE-2022-23460

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...

Design/Logic Flaw

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...

CVE-2022-23460

Jsonxx/Json++ (C++) has a stack-exhaustion vulnerability in the json parsing path, potentially causing Denial of Service on affected builds. The issue is observed in the current commit and is associated with ASAN builds; the project is archived and updates are not expected. Several sources (NVD, ...

CVE-2022-23460 Stack overflow in Jsonxx

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...

Jsonxx 安全漏洞

Jsonxx is a lightweight Json parser, writer, and reader written in C++ by the individual developer Hong Jiang in China. A security vulnerability exists in Jsonxx, which stems from the fact that json parsing can lead to stack exhaustion in address sanitization ASAN builds, and can be exploited by ...

PT-2022-16002 · Jsonxx · Jsonxx

Name of the Vulnerable Software and Affected Versions: jsonxx affected versions not specified Description: The issue is related to json parsing in jsonxx, which may lead to stack exhaustion in an address sanitized ASAN build. This can cause a Denial of Service if the program using the jsonxx...

golang: go/parser: stack exhaustion in all Parse* functions

A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability...

golang: encoding/xml: stack exhaustion in Decoder.Skip

A flaw was found in golang encoding/xml. When calling Decoder, Skip while parsing a deeply nested XML document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

golang: path/filepath: stack exhaustion in Glob

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability...

golang: encoding/xml: stack exhaustion in Unmarshal

A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion...

golang: compress/gzip: stack exhaustion in Reader.Read

A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...

CLSA-2022-1660760528 Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823

SECURITY UPDATE: Stack exhaustion - debian/patches/CVE-2022-25313.patch: prevent stack exhaustion in buildmodel in expat/lib/xmlparse.c. - debian/patches/fix-buildmodel-regression.patch: fix buildmodel regression in expat/lib/xmlparse.c. - CVE-2022-25313 SECURITY UPDATE: Integer overflow -...

CLSA-2022-1660758476 Fixed 15 CVEs in expat

CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs - CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution - CVE-2022-25315: Fix integer overflow in storeRawNames - CVE-2022-22822: Fix integer overflow in addBinding -...