145727 matches found
openssh: OpenSSH: sftp client allows attacker to control downloaded file location
A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...
net/http: golang: golang: Denial of Service via crafted HTTP Range headers
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...
Important: Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello ECH outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a...
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow
A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...
Important: Red Hat Security Advisory: libxml2 security update
An update for libxml2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the xmlParseInternalSubset function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service DoS, making the affected system or application...
libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the xmlSnprintfElements function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited...
libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...
libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...
libxml2: double-free/UAF in libxml2 Python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello ECH outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
net/http: golang: golang: Denial of Service via crafted HTTP Range headers
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...
Important: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
Important: Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update
An update for lrzsz is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode
A flaw was found in lrzsz. The lrz receive utility fails to properly sanitize absolute file paths in restricted mode, only checking for relative path traversal sequences. A remote attacker transmitting files can exploit this vulnerability to write or overwrite arbitrary files outside the intended...
lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode
A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary...
firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine: JIT component...
firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure, privilege escalation in the Security: Process Sandboxing component...
firefox: Sandbox escape due to uninitialized memory in the Graphics component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to uninitialized memory in the Graphics component...
firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Race condition, use-after-free in the Graphics: CanvasWebGL component...
firefox: Integer overflow in the Layout: Text and Fonts component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Layout: Text and Fonts component...
firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget
A flaw was found in Firefox. Incorrect boundary condition handling in the Win32 widget component allows an attacker to escape the browser's restricted sandbox environment. An attacker who has compromised a sandboxed content process could exploit this vulnerability to achieve privilege escalation...
firefox: Use-after-free in the Storage: IndexedDB component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: IndexedDB component...
firefox: Sandbox escape due to incorrect boundary conditions in the Networking component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Networking component...
firefox: Use-after-free in the XML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...
expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer
A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist ...
libexpat: denial of service via crafted XML input
A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...
firefox: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: Incorrect boundary conditions in the JavaScript Engine component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine component...
firefox: Integer overflow in the Graphics component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics component...
firefox: Incorrect boundary conditions in the JavaScript Engine component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine component...
firefox: Use-after-free in the DOM: Bindings (WebIDL) component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Bindings WebIDL component...
firefox: Use-after-free in the DOM: Animation component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Animation component...
firefox: Use-after-free in the Audio/Video component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...
firefox: Use-after-free in the Crash Reporting component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Crash Reporting component...
firefox: Use-after-free in the SVG component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...
Important: Red Hat Security Advisory: firefox security, bug fix, and enhancement update
An update for firefox is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
firefox: Use-after-free in the JavaScript Engine: JIT component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...
firefox: Use-after-free in the DOM: Streams component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Streams component...
firefox: thunderbird: Privilege escalation in the Application Update component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Application Update component...
firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component...
firefox: Sandbox escape due to use-after-free in the Networking component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Networking component...