DEBIAN-CVE-2023-2617

A vulnerability classified as problematic was found in OpenCV wechatqrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decodedbitstreamparser.cpp. The manipulation leads to null pointer dereference. The...

CVE-2022-36937: Use of a Broken or Risky Cryptographic Algorithm

HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications...

PT-2023-13512 · Facebook · Hhvm

Name of the Vulnerable Software and Affected Versions: HHVM versions 4.172.0 and all prior versions Description: The issue arises from HHVM using TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS 1.0 has numerous published vulnerabilities and is deprecated...

Facebook HHVM security vulnerability

Facebook HHVM a.k.a. HipHop Virtual Machine is a virtual machine from Facebook, Inc. that significantly improves the performance of loading dynamic pages in PHP. A security vulnerability exists in Facebook HHVM version 4.172.0 and earlier, which stems from the use of TLS 1.0 for secure connection...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.3) +35 more potentially affected by CVE-2023-31126 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.3 and more Source cves: CVE-2023-31126 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.3) +35 more potentially affected by CVE-2023-31126 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.3 and more Source cves: CVE-2023-31126 Source...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

kernel: drm/amd/display: Check correct bounds for stream encoder instances for DCN303

A flaw was found in the Linux kernel's AMD display driver. A missing boundary check when referencing stream encoder instances on DCN303 hardware allows an out-of-bounds memory access. A local user could exploit this vulnerability to cause a denial of service DoS or potentially expose sensitive...

Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common

A NULL pointer dereference issue was found in the SCTP network protocol in net/sctp/streamsched.c in the Linux kernel. If streamin allocation fails, streamout is freed, which would be accessed further. This flaw allows a local user to crash the system or potentially cause a denial of service...

Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common

A NULL pointer dereference issue was found in the SCTP network protocol in net/sctp/streamsched.c in the Linux kernel. If streamin allocation fails, streamout is freed, which would be accessed further. This flaw allows a local user to crash the system or potentially cause a denial of service...

golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests...

ALSA-2023:2216 Moderate: gdk-pixbuf2 security update

The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fixes: gdk-pixbuf: heap-buffer overflow when decoding the lzw compressed stream of image data CVE-2021-44648 gdk-pixbu...

Russian ‘Ghost Ships’ Identified Near the Nord Stream Blasts

Plus: Apple and Google plan to stop AirTag stalking, Meta violated the FTC’s privacy order, and how to tell if your car is tracking you...

Ubuntu 22.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6057-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6057-1 advisory. It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker...

Password Disclosure

akka-stream-kafka is vulnerable to Password Disclosure. The vulnerability exists because it does not redact the Consumer or Producer properties in logs, which allows an attacker to read credentials as plaintext through the akka.kafka.internal.KafkaConsumerActor when debug logging is enabled...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.

...

com.github.j5ik2o:akka-persistence-dynamodb-kafka-write-adaptor_2.12 (1.1.0), com.github.j5ik2o:akka-persistence-kafka-awesome_2.12 (1.0.0) +6 more potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.12 (2.0.2)

com.typesafe.akka:akka-stream-kafka2.12 MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-stream-kafka2.12 and may be impacted: - com.github.j5ik2o:akka-persistence-dynamodb-kafka-write-adaptor2.12 1.1.0 -...

com.typesafe.akka:akka-stream-kafka-testkit_2.12 (1.1.0-rc2) potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.12 (1.1.0-rc2)

com.typesafe.akka:akka-stream-kafka2.12 MAVEN version 1.1.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-stream-kafka2.12 and may be impacted: - com.typesafe.akka:akka-stream-kafka-testkit2.12 1.1.0-rc2 Source cves:...

com.lightbend.akka:akka-platform-dependencies_2.13 (0.3.0), com.typesafe.akka:akka-stream-kafka-cluster-sharding_2.13 (3.0.1) +4 more potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.13 (3.0.1)

com.typesafe.akka:akka-stream-kafka2.13 MAVEN version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-stream-kafka2.13 and may be impacted: - com.lightbend.akka:akka-platform-dependencies2.13 0.3.0 -...