XStream Remote Code Execution Vulnerability

XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

EulerOS 2.0 SP9 : containerd (EulerOS-SA-2023-1462)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the hos...

VulnCheck KEV: CVE-2021-39144

XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware...

frr:zebra: Crash in qfree

Detailed Report: https://oss-fuzz.com/testcase?key=4783257326845952 Project: frr Fuzzing Engine: libFuzzer Fuzz Target: zebra Job Type: libfuzzerubsanfrr Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000a0a0a0a02 Crash State: qfree streamfree zservhandlecommands Sanitizer: undefine...

PT-2023-35446

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.169 Description A potential issue in the ASoC SOF Intel hda-dai component may lead to a stream tag leak. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2023-35375

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.1.13 Description A potential issue in the ASoC SOF Intel hda-dai component may lead to a stream tag leak. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2023-35417 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.95 Description: A potential issue in the ASoC: SOF: Intel: hda-dai component may lead to a stream tag leak. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

org.xwiki.commons:xwiki-commons-diff-script (>=14.0-rc-1, <=14.4.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.0-rc-1, <=14.4.3) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.0-rc-1, <=14.4.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.4.3 and more Source cves: CVE-2023-26055 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.0-rc-1, <=14.4.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.0-rc-1, <=14.4.3) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.0-rc-1, <=14.4.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.4.3 and more Source cves: CVE-2023-26055 Source...

Avoid The Randomness From The Sky

This is a plea for cryptography specification authors. If your protocol uses randomness, please make it a deterministic function that takes a fixed-size string of random bytes , and publish known-answer tests for it. This whole issue could really be just the paragraph above, but I feel like I nee...

org.xwiki.commons:xwiki-commons-diff-script (>=14.0-rc-1, <=14.4.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.0-rc-1, <=14.4.3) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.0-rc-1, <=14.4.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.4.3 and more Source cves: CVE-2023-26055 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.5, <=14.6), org.xwiki.commons:xwiki-commons-diff-xml (>=14.5, <=14.6) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.5, <=14.6)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.6 and more Source cves: CVE-2023-26055 Source advisory: MEND:CVE-2023-26055...

A Bootiful Podcast: Spring Cloud Stream and Spring Cloud Function lead Oleg Zhurakousky

Hi Spring fans! Welcome to another installment of a bootiful podcast! in this installment, our pal Oleg Zhurakousky @zoleg, lead of Spring Cloud Stream and Spring Cloud Function, rejoins the show to talk about the latest and greatest in stream processing...

USN-5880-2 firefox regressions

USN-5880-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Christian Holler discovered that Firefox did not properly manage memory when using PKCS 12 Safe Bag attribute...

SUSE CVE-2023-1074

A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service...

AZL-37377 CVE-2022-41723 affecting package golang for versions less than 1.21.6-1

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests...

CVE-2022-41723

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests...