CLSA-2024-1735065830 Fix CVE(s): CVE-2024-11233

SECURITY UPDATE: Security vulnerability in package - debian/patches/CVE-2024-11233.patch: fix error in convert.quoted printable-decode filter certain data leading to buffer overread. Fix segfault with streams and invalid data. - CVE-2024-11233...

CLSA-2024-1735064231 Fix CVE(s): CVE-2024-11234

SECURITY UPDATE: Security vulnerability - debian/patches/CVE-2024-11234.patch: Fix stream HTTP fulluri CRLF injection issue - CVE-2024-11234...

Freedesktop Poppler 安全漏洞

Freedesktop Poppler is a Freedesktop community C++ class library for generating PDFs, which is inherited from Xpdf PDF reader. A security vulnerability exists in Freedesktop Poppler version 24.12.0 and earlier versions, which stems from an out-of-bounds read vulnerability in libpoppler.so in the...

Important: xstream

Issue Overview: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream. XStream provides a BinaryStreamDriver with an own optimized serialization format. The format uses ids for string values as deduplication. The mapping for these ids are...

sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start

...

sctp: properly validate chunk size in sctp_sf_ootb()

...

DEBIAN-CVE-2024-47602

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. This function does not properly check the validity of the stream-codecpriv pointer in th...

UBUNTU-CVE-2024-47602

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. This function does not properly check the validity of the stream-codecpriv pointer in th...

PT-2024-29259 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow affected versions not specified Description: A flaw was found in Undertow, where an HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2...

Configuring a proxy in a stream context might allow for CRLF injection in URIs

...

Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial (CVE-2015-0670)

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482. This plugin only works with...

The vulnerability of the processAtatchmentDataStream method implementation in the software for remote monitoring, management, and support of servers and data storage systems, HPE Insight Remote Support, allows a attacker to execute arbitrary code.

The vulnerability of the processAtatchmentDataStream method implementation in the software for remote monitoring, management, and support of servers and data storage systems in HPE Insight Remote Support relates to the use of files and directories accessible to external parties. Exploiting this...

PT-2024-10590 · Unknown · Libmpeg2Dec

Name of the Vulnerable Software and Affected Versions: libmpeg2dec affected versions not specified Description: The issue is related to a possible out-of-bounds OOB read in the impeg2d bit stream flush function of libmpeg2dec due to a missing bounds check. This could lead to a remote Denial of...

CVE-2024-11234 Configuring a proxy in a stream context might allow for CRLF injection in URIs

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests...

CVE-2024-11234

The CVE-2024-11234 entry concerns HTTP request smuggling via PHP streams when a proxy is configured and the request_fulluri option is used. Affected PHP versions are 8.1.* before 8.1.31, 8.2.* before 8.2.26, and 8.3.* before 8.3.14. The vulnerability arises from improper URI sanitization in strea...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in pdf/pdfxref.c in Artifex Ghostscript prior to version 10.04.0. There is a buffer overflow that occurs during the handling of a PDF XRef stream related to W array values...

SUSE CVE-2024-11612

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on th...

DEBIAN-CVE-2024-11612

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on th...

UBUNTU-CVE-2024-11612

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on th...

CVE-2024-11612

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on th...