OSV-2020-960 Use-of-uninitialized-value in prvTidyDecodeUTF8BytesToChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12656 Crash type: Use-of-uninitialized-value Crash state: prvTidyDecodeUTF8BytesToChar prvTidyGetUTF8 PPrintText...

nodejs: memory corruption in napi_get_value_string_* functions

A flaw was found in nodejs. Calling napigetvaluestringlatin1, napigetvaluestringutf8, or napigetvaluestringutf16 with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer...

OSV-2020-843 Heap-buffer-overflow in uni_utf8_get_char_n

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23513 Crash type: Heap-buffer-overflow READ 1 Crash state: uniutf8getcharn smtpcommandparseparameters smtpcommandparseline...

SUSE SLED15 / SLES15 Security Update : freetds (SUSE-SU-2020:1417-2)

This update for freetds to 1.1.36 fixes the following issues : Security issue fixed : CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 bsc1141132. Non-security issues fixed : Enabled Kerberos support Version update ...

SUSE-SU-2020:1417-2 Security update for freetds

This update for freetds to 1.1.36 fixes the following issues: Security issue fixed: - CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 bsc1141132. Non-security issues fixed: - Enabled Kerberos support - Version upda...

Huawei EulerOS: Security Advisory for less (EulerOS-SA-2020-1770)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.6.0 : less (EulerOS-SA-2020-1770)

According to the versions of the less package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The isutf8wellformed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8...

EulerOS Virtualization for ARM 64 3.0.6.0 : pcre2 (EulerOS-SA-2020-1702)

According to the version of the pcre2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An out-of-bounds read was discovered in PCRE when the pattern '\X' is JIT compiled and used to match specially crafted...

CVE-2019-20838

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. Mitigation Do not use more than one fixed quantifier with \R or \X with UTF disabled in PCRE or PCRE2, as these are the...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

AZL-44877 CVE-2020-14040 affecting package buildah for versions less than 1.41.4-2

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

AZL-44364 CVE-2020-14040 affecting package podman for versions less than 5.6.1-2

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

Design/Logic Flaw

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

UBUNTU-CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

CVE-2020-14040 affects golang.org/x/text/encoding/unicode and golang.org/x/text/transform in the x/text package for Go, with a vulnerability in encoding/unicode that can cause the UTF-16 decoder to enter an infinite loop, potentially crashing or exhausting memory when a single byte is supplied to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

Denial Of Service (DoS)

github.com/golang/text is vulnerable to denial of service DoS. The attack is possible because it does not properly handle the single-byte UTF-16 inputs passing to a UTF-16 decoder, causing an infinite loop if the return value from transformer is ErrShortSrc with atEOF true...