| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. |
| In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.
The impacted component is io.vertx:vertx-mysql-client. |
| In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.
This can be exploited for request smuggling purpose.
The impacted component is io.vertx:vertx-core. |
| In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.
The impacted component is io.vertx:vertx-json-schema.
The following Vert.x modules depend on vertx-json-schema and are also affected:
io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi |
| SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. |
| renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. |
| The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.
A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation. |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. |
| Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally. |
| A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce. |
| Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally. |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. |
| Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. |
| Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network. |
