CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

dbs-address-space (>=0.1.0, <=0.3.0), dbs-arch (>=0.1.0, <=0.2.3) +24 more potentially affected by CVE-2023-50711 via vmm-sys-util (>=0.7.0, <=0.11.2)

vmm-sys-util CARGO version =0.7.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.5.0, =0.1.0, =0.9.3, =0.3.1, =0.6.1, =0.1.1, =0.3.1 - sev 0.1.0 and more Source cves: CVE-2023-50711 Source advisory: OSV:GHSA-875G-MFP6-G7F9...

dbs-address-space (>=0.1.0, <=0.3.0), dbs-arch (>=0.1.0, <=0.2.3) +24 more potentially affected by CVE-2023-50711 via vmm-sys-util (>=0.7.0, <=0.11.2)

vmm-sys-util CARGO version =0.7.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.5.0, =0.1.0, =0.9.3, =0.3.1, =0.6.1, =0.1.1, =0.3.1 - sev 0.1.0 and more Source cves: CVE-2023-50711 Source advisory: OSV:RUSTSEC-2024-0002...

PT-2024-2723

Name of the Vulnerable Software and Affected Versions vmm-sys-util versions 0.5.0 through 0.12.0 Description The issue is related to the FamStructWrapper::deserialize implementation, which can lead to out of bounds memory accesses due to a mismatch between the length stored in the header and the...

CVE-2023-50711: Out-of-bounds Write

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

PT-2023-31758

Name of the Vulnerable Software and Affected Versions hutool-core version 5.8.23 Description The NumberUtil.toBigDecimal method in hutool-core was discovered to contain a stack overflow. Recommendations For hutool-core version 5.8.23, consider disabling the toBigDecimal method in the NumberUtil...

GHSA-MH8J-9JVH-GJF6 mockjs vulnerable to Prototype Pollution via the Util.extend function

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, o...

CVE-2023-26158

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, o...

Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by a vulnerability in APR-util (CVE-2017-12613)

Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerability in APR-util. Vulnerability Details CVEID: CVE-2017-12613 DESCRIPTION: Apache Portable Runtime APR could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds array...

PT-2023-20535 · Mockjs · Mockjs

Name of the Vulnerable Software and Affected Versions: mockjs versions prior to a version with the fixed Util.extend function Description: The issue arises from a missing check in the Util.extend function, allowing Prototype Pollution. This occurs when an attribute resolves to the object prototyp...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

Privilege escalation

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

CVE-2023-45839

CVE-2023-45839 concerns Buildroot (2023.08.1 and dev commit 622698d7847) with multiple data-integrity vulnerabilities in the package hash checking, related to aufs-util. Talos confirms Buildroot is susceptible to MITM-based tampering of downloaded sources (no hash/check for certain packages), ena...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

CVE-2023-45839: Download of Code Without Integrity Check

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...

PT-2023-29725

Name of the Vulnerable Software and Affected Versions Buildroot versions 2023.08.1 through dev commit 622698d7847 Description Multiple data integrity vulnerabilities exist in the package hash checking functionality. A specially crafted man-in-the-middle attack can lead to arbitrary command...

Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

MAL-2023-8637 Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

util-linux bug fix and enhancement update

An update is available for util-linux. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8...