CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

CVE-2023-50711

CVE-2023-50711 affects the vmm-sys-util crate (FamStructWrapper::deserialize) used by Rust-VMM components. The issue is a mismatch between the header-stored length and the flexible-array length during deserialization, enabling potential out-of-bounds memory access through Rust-safe code. It was f...

CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

PT-2023-31758 · Unknown · Hutool-Core

Name of the Vulnerable Software and Affected Versions: hutool-core version 5.8.23 Description: The NumberUtil.toBigDecimal method in hutool-core was discovered to contain a stack overflow. Recommendations: For hutool-core version 5.8.23, consider disabling the toBigDecimal method in the NumberUti...

GHSA-MH8J-9JVH-GJF6 mockjs vulnerable to Prototype Pollution via the Util.extend function

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, o...

CVE-2023-26158

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, o...

Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by a vulnerability in APR-util (CVE-2017-12613)

Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerability in APR-util. Vulnerability Details CVEID: CVE-2017-12613 DESCRIPTION: Apache Portable Runtime APR could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds array...

PT-2023-20535 · Mockjs · Mockjs

Name of the Vulnerable Software and Affected Versions: mockjs versions prior to a version with the fixed Util.extend function Description: The issue arises from a missing check in the Util.extend function, allowing Prototype Pollution. This occurs when an attribute resolves to the object prototyp...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

Privilege escalation

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

CVE-2023-45839

CVE-2023-45839 concerns Buildroot (2023.08.1 and dev commit 622698d7847) with multiple data-integrity vulnerabilities in the package hash checking, related to aufs-util. Talos confirms Buildroot is susceptible to MITM-based tampering of downloaded sources (no hash/check for certain packages), ena...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

MAL-2023-8637 Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

util-linux bug fix and enhancement update

An update is available for util-linux. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8...

K000137702: Apache vulnerability CVE-2022-25147

Security Advisory Description Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility APR-util 1.6.1 and prior versions. CVE-2022-25147...

F5 Networks BIG-IP : Apache vulnerability (K000137702)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137702 advisory. Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util...

SUSE: Security Advisory (SUSE-SU-2023:4512-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...