GHSA-XH29-R2W5-WX8M Nokogiri Improperly Handles Unexpected Data Type

Summary Nokogiri = 1.13.6. JRuby users are not affected. Workarounds To avoid this vulnerability in affected applications, ensure the untrusted input is a String by calling tos or equivalent. Credit This vulnerability was responsibly reported by @agustingianni and the Github Security Lab...

CVE-2022-29181

A flaw was found in the rubygem-nokogiri package. This flaw allows malicious users to change partial contents or configurations on the system. Additionally, this vulnerability can also cause a limited denial of service in the form of interruptions in resource availability. Mitigation To avoid thi...

GNU LibreDWG 缓冲区错误漏洞

GNU LibreDWG is a C library for processing DWG files from the GNU community.A heap buffer overflow vulnerability exists in versions of GNU LibreDWG prior to 0.12.4, which stems from a boundary error in copybytes of decoder2007.c when handling untrusted input. No detailed vulnerability details are...

GNU LibreDWG 缓冲区错误漏洞

GNU LibreDWG is a C library for processing DWG files from the GNU community.A heap buffer overflow vulnerability exists in versions of GNU LibreDWG prior to 0.12.4, which stems from a boundary error in copycompressedbytes of decoder2007.c when handling untrusted input. No detailed vulnerability...

Mozilla Firefox Security Advisory (MFSA2022-19) - Linux

The remote host is missing an update for Mozilla Firefox, announced via the advisory MFSA2022-19. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Updated ruby-nokogiri packages fix security vulnerability

Nokogiri did not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors segfault or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a...

DEBIAN-CVE-2022-29181

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors segfault or reads from unrelated memory. Version 1.13.6...

UBUNTU-CVE-2022-29181

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors segfault or reads from unrelated memory. Version 1.13.6...

OpenRazer 安全漏洞

OpenRazer is an open source driver and userspace daemon used to control Razer lighting and other functions on GNU/Linux. Used to control Razer lighting and other features on GNU/Linux, a buffer overflow vulnerability exists in OpenRazer version 3.3.0 and earlier, which stems from a boundary error...

Linux kernel buffer overflow vulnerability (CNVD-2022-38757)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable to a buffer overflow vulnerability that stems from a boundary error in iouring when handling untrusted input. A remote attacker could exploit this vulnerability to cause an...

VMware Spring Security 授权问题漏洞

VMware Spring Security is a security framework from VMware that provides illustrative security protections for Spring-based applications. An authorization issue vulnerability exists in VMware Spring Security that stems from the use of RegexRequestMatcher and the wildcard . character of a regular...

Apple TV 缓冲区错误漏洞

Apple macos is a set of operating systems from the American company Apple. Apple macos suffers from a buffer overflow vulnerability that originates from a boundary error in the Wi-Fi component when handling untrusted input. An attacker could exploit the vulnerability to access sensitive informati...

D-Link DIR-816 A2 Buffer Overflow Vulnerability (CNVD-2022-42153)

The D-Link DIR-816 A2 is a wireless router from D-Link, Taiwan, China.A buffer overflow vulnerability exists in the D-Link DIR-816 A2, which stems from a boundary error in the addurlfilter parameter in /goform/websURLFilter when handling untrusted input, which could be exploited by an attacker to...

D-Link DIR-816 Buffer Overflow Vulnerability (CNVD-2022-64490)

The D-Link DIR-816 is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link DIR-816 A2v1.10CNB04 firmware version, which originates from a boundary error in the lanip parameter in /goform/setNetworkLan when handling untrusted input. An attacker...

VulnCheck KEV: CVE-2021-31805

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead...

Tenda AX1803 缓冲区错误漏洞

Tenda AX1803 is a dual-band gigabit WIFI6 router from Tenda China.Tenda AX1803 v1.0.0.1 12890 suffers from a denial of service vulnerability. The vulnerability stems from a boundary error in the ntpserve parameter when handling untrusted input. A remote attacker could exploit the vulnerability to...

D-Link DIR-816 A2 缓冲区错误漏洞

The D-Link DIR-816 A2 is a wireless router from D-Link, Taiwan, China.A buffer overflow vulnerability exists in the D-Link DIR-816 A2, which stems from a boundary error in the addurlfilter parameter in /goform/websURLFilter when handling untrusted input, which could be exploited by an attacker to...

D-Link DIR-816 A2 缓冲区错误漏洞

The D-Link DIR-816 is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link DIR-816 A2v1.10CNB04 version, which originates from a boundary error in the addhostfilter parameter in the device/goform/websHostFilter when processing untrusted input. A...

D-Link DIR-816 A2 缓冲区错误漏洞

The D-Link DIR-816 is a wireless router from AUO D-Link of Taiwan, China. The D-Link DIR-816 A2v1.10CNB04 firmware version suffers from a buffer overflow vulnerability that originates from a boundary error in the MAC parameter in /goform/editassignment when handling untrusted input. An attacker...

D-Link DIR-816 A2 缓冲区错误漏洞

The D-Link DIR-816 is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link DIR-816 A2v1.10CNB04 version, which originates from a boundary error in the urladd parameter in the device/goform/websURLFilterAddDel when processing untrusted input. An...