When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

Affected: Maven: org.apache.commons:commons-compress

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

jquery: Cross-site scripting via cross-domain ajax requests logback: Serialization vulnerability in SocketServer and ServerSocketReceiver js-jquery: XSS in responses from cross-origin ajax requests apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip jetty: full server path revealed when using the default Error Handling springframework: DoS Attack via Range Requests spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed c3p0: loading XML configuration leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service HTTP/2: flood using empty frames results in excessive resource consumption infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods undertow: Information leak in requests for directories without trailing slashes jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions jetty: error path information disclosure spring-secur…

Affected: Ubuntu:16.04:LTS: libcommons-compress-java, Ubuntu:18.04:LTS: libcommons-compress-java

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen