Google Golang 资源管理错误漏洞

Google Go is a development language of Google, Inc. Google Go memory consumption vulnerability, which originates from regexp. The compilation process may deplete stack resources through deeply nested expressions, which can be exploited by attackers to consume system resources...

SUSE SLES12 Security Update : expat (SUSE-SU-2022:0698-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0698-1 advisory. - CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs bsc1196025. - CVE-2022-25235: Fixed...

CVE-2022-24921

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression...

CVE-2022-24921

Removed by vendor...

SUSE: Security Advisory (SUSE-SU-2022:14903-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-24921

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression...

CVE-2022-24921

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression...

CVE-2022-24921

CVE-2022-24921 affects the Go language’s standard library (regexp.Compile). The issue allows stack exhaustion via a deeply nested regular expression, leading to denial of service. The root cause is a vulnerability in regexp handling that can consume stack memory under certain inputs. Rationale: i...

CVE-2022-24921

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression...

openSUSE 15 Security Update : expat (openSUSE-SU-2022:0713-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0713-1 advisory. - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val...

SUSE-SU-2022:14903-1 Security update for expat

This update for expat fixes the following issues: - CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs bsc1196025. - CVE-2022-25235: Fixed UTF-8 character validation in a certain context bsc1196026. - CVE-2022-25313: Fixed stack exhaustion in buildmodel vi...

OPENSUSE-SU-2022:0713-1 Security update for expat

This update for expat fixes the following issues: - CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs bsc1196025. - CVE-2022-25235: Fixed UTF-8 character validation in a certain context bsc1196026. - CVE-2022-25313: Fixed stack exhaustion in buildmodel vi...

Security update for expat (important)

openSUSE Security Update: Security update for expat Announcement ID: openSUSE-SU-2022:0713-1 Rating: important References: 1196025 1196026 1196168 1196169 1196171 Cross-References: CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315 CVSS scores: CVE-2022-25235 NVD : 9.8...

In Expat (aka libexpat) before 2.4.5 an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

...

Envoy has an unspecified vulnerability (CNVD-2022-16288)

Envoy is an open source distributed proxy server. Envoy has a security vulnerability that can be exploited by attackers to cause stack exhaustion and abnormal process termination...

CVE-2022-23606

A flaw was found in envoy. When a cluster is deleted via the Cluster Discovery Service, a stack exhaustion may occur...

CVE-2022-23606

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service CDS all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle...

CVE-2022-23606 Crash when a cluster is deleted in Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service CDS all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle...

Updated expat packages fix security vulnerability

Passing malformed 2- and 3-byte UTF-8 sequences e.g. from start tag names to the XML processing application on top of Expat can cause arbitrary damage e.g. code execution depending on how invalid UTF-8 is handled inside the XML processor; validation was not their job but Expat's. Exploits with co...

MGASA-2022-0081 Updated expat packages fix security vulnerability

Passing malformed 2- and 3-byte UTF-8 sequences e.g. from start tag names to the XML processing application on top of Expat can cause arbitrary damage e.g. code execution depending on how invalid UTF-8 is handled inside the XML processor; validation was not their job but Expat's. Exploits with co...