Most recent entries from all

bdu:2017-02383

Withdrawn: BELL-CVE-2016-9842 — CVE-2016-9842 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2017-avi-320 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2017-avi-320

cnvd-2016-13296

EUVD-2026-336230

fkie_cve-2016-9842

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

GHSA-3686-jjcf-4w27

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

gsd-2016-9842

ICSA-19-155-01 — PHOENIX CONTACT PLCNext AXC F 2152

A remote attacker can exploit a server 's private key by sending carefully constructed UserIdentityTokens encrypted with the Basic128Rsa15 security policy. This could allow an attacker to decrypt passwords even if encrypted with another security policy such as Basic256Sha256. CVE-2018-7559 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L). An attacker with physical access to the device can manipulate SD card data, which could allow an attacker to bypass the authentication of the device. This device is designed for use in a protected industrial environment with restricted physical access.CVE-2019-10998 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker trying to connect to the device using a man-in-the-middle setup may crash the PLC service, resulting in a denial of service condition. The device must then be rebooted, or the PLC service must be restarted manually via Linux shell.CVE-2019-10997 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly ha…

msrc_CVE-2016-9842 — The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact

msrc_CVE-2016-9842

NCSC-2026-0229 — Kwetsbaarheden verholpen in Siemens producten

NCSC-2026-0229

OESA-2023-1433 — syslinux security update

Affected: openEuler:20.03-LTS-SP1: syslinux, openEuler:20.03-LTS-SP3: syslinux, openEuler:22.03-LTS: syslinux, openEuler:22.03-LTS-SP1: syslinux, openEuler:22.03-LTS-SP2: syslinux

Security Fix(es): inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.(CVE-2016-9840) The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.(CVE-2016-9842) CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.(CVE-2016-9843)

RHSA-2017:1220 — Red Hat Security Advisory: java-1.8.0-ibm security update

zlib: Out-of-bound pointer arithmetic in inftrees.c zlib: Out-of-bounds pointer arithmetic in inffast.c zlib: Undefined left shift of negative number zlib: Big-endian out-of-bounds pointer JDK: XML External Entity Injection (XXE) error when processing XML data OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520) OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528) OpenJDK: newline injection in the FTP client (Networking, 8170222) OpenJDK: MD5 allowed for jar verification (Security, 8171121) OpenJDK: newline injection in the SMTP client (Networking, 8171533)

SSA-470355 — SSA-470355: Zlib and Foxit Vulnerabilities in CADRA

CADRA is affected by multiple zlib and Foxit vulnerabilities.

Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

SUSE-SU-2016:3209-1 — Security update for zlib

Security update for zlib

UBUNTU-CVE-2016-9842

Affected: Ubuntu:Pro:14.04:LTS: zlib, Ubuntu:16.04:LTS: rsync, Ubuntu:16.04:LTS: zlib, Ubuntu:16.04:LTS: zsync, Ubuntu:18.04:LTS: rsync, Ubuntu:18.04:LTS: zsync, Ubuntu:20.04:LTS: rsync, Ubuntu:20.04:LTS: zsync, Ubuntu:22.04:LTS: zsync, Ubuntu:24.04:LTS: zsync and 2 more

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

VDE-2019-009 — PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152

Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x

WID-SEC-W-2024-1232 — Rsync: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um beliebigen Programmcode auszuführen, oder einen Denial of Service Zustand herbeizuführen.