https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:35:50 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-03864 bdu:2019-03864 https://cve.radiocsirt.org/vuln/bdu:2019-03864 https://cve.radiocsirt.org/vuln/bell-cve-2019-3862 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2019-3862 https://cve.radiocsirt.org/vuln/certfr-2019-avi-573 certfr-2019-avi-573 https://cve.radiocsirt.org/vuln/certfr-2019-avi-573 https://cve.radiocsirt.org/vuln/cnvd-2019-07800 cnvd-2019-07800 https://cve.radiocsirt.org/vuln/cnvd-2019-07800 https://cve.radiocsirt.org/vuln/euvd-2026-49766 EUVD-2026-49766 https://cve.radiocsirt.org/vuln/euvd-2026-49766 https://cve.radiocsirt.org/vuln/fkie_cve-2019-3862 <p>An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.</p> <p>An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-3862 https://cve.radiocsirt.org/vuln/ghsa-5c3r-rx33-wr79 <p>An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.</p> <p>An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.</p> https://cve.radiocsirt.org/vuln/ghsa-5c3r-rx33-wr79 https://cve.radiocsirt.org/vuln/gsd-2019-3862 gsd-2019-3862 https://cve.radiocsirt.org/vuln/gsd-2019-3862 https://cve.radiocsirt.org/vuln/icsa-23-348-10 <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> https://cve.radiocsirt.org/vuln/icsa-23-348-10 https://cve.radiocsirt.org/vuln/opensuse-su-2019:1109-1 <p>Security update for libssh2_org</p> <p>Security update for libssh2_org</p> https://cve.radiocsirt.org/vuln/opensuse-su-2019:1109-1 https://cve.radiocsirt.org/vuln/rhba-2020:0547 <p>glibc: getaddrinfo should reject IP addresses with trailing characters ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: timing side channel attack in the DSA signature algorithm procps: Local privilege escalation in top LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp nss: Cache side-channel variant of the Bleichenbacher attack binutils: Stack Exhaustion in the demangling functions provided by libiberty binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c. curl: NTLM password overflow via integer overflow python: Missing salt initialization in _elementtree.c module systemd: line splitting via fgets() allows for state injection during daemon-reexec elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file elfutils: Double-free due to double decompression of sections in crafted ELF causes crash elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash curl: Heap-based buffer over-read in the curl tool warning formatting systemd: out-of-bounds read when parsing a crafted syslog message systemd: kills privileged process if unprivileged PIDFile was tampered elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl elfutils: eu-size cannot handle recursive ar files elfutils: Divide-by-zero in arlib_add_symbols functio…</p> <p>glibc: getaddrinfo should reject IP addresses with trailing characters ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: timing side channel attack in the DSA signature algorithm procps: Local privilege escalation in top LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp nss: Cache side-channel variant of the Bleichenbacher attack binutils: Stack Exhaustion in the demangling functions provided by libiberty binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c. curl: NTLM password overflow via integer overflow python: Missing salt initialization in _elementtree.c module systemd: line splitting via fgets() allows for state injection during daemon-reexec elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file elfutils: Double-free due to double decompression of sections in crafted ELF causes crash elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash curl: Heap-based buffer over-read in the curl tool warning formatting systemd: out-of-bounds read when parsing a crafted syslog message systemd: kills privileged process if unprivileged PIDFile was tampered elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl elfutils: eu-size cannot handle recursive ar files elfutils: Divide-by-zero in arlib_add_symbols functio…</p> https://cve.radiocsirt.org/vuln/rhba-2020:0547 https://cve.radiocsirt.org/vuln/suse-su-2019:0655-1 <p>Security update for libssh2_org</p> <p>Security update for libssh2_org</p> https://cve.radiocsirt.org/vuln/suse-su-2019:0655-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-3862 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libssh2, Ubuntu:Pro:16.04:LTS: libssh2, Ubuntu:Pro:18.04:LTS: libssh2</p> <p>An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libssh2, Ubuntu:Pro:16.04:LTS: libssh2, Ubuntu:Pro:18.04:LTS: libssh2</p> <p>An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-3862 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1230 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libssh2 ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libssh2 ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1230