Most recent entries from all

bdu:2023-08465

certfr-2023-avi-0276 — De multiples vulnérabilités ont été découvertes dans IBM. Elles permettent à un attaquant d…

certfr-2023-avi-0276

Withdrawn: CLEANSTART-2026-MG63413 — Security fixes in spark-sc213-jdk17-py312 3.5.8-r0

Withdrawn by the publisher.

Affected: CleanStart: spark-sc213-jdk17-py312

Package spark-sc213-jdk17-py312 version 3.5.8-r0 fixes 74 vulnerabilities: CVE-2026-54515, ghsa-5jmj-h7xm-6q6v, ghsa-337m-mw94-2v6g, CVE-2026-45205, ghsa-2r2c-cx56-8933...

EUVD-2026-232058

fkie_cve-2022-40152

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

GHSA-3f7h-mf4q-vrm4 — Denial of Service due to parser crash

Affected: Maven: com.fasterxml.woodstox:woodstox-core

Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.

gsd-2022-40152

OESA-2024-2378 — woodstox-core security update

Affected: openEuler:22.03-LTS-SP1: woodstox-core, openEuler:24.03-LTS: woodstox-core, openEuler:22.03-LTS-SP4: woodstox-core, openEuler:22.03-LTS-SP3: woodstox-core, openEuler:20.03-LTS-SP4: woodstox-core

Woodstox is a high-performance validating namespace-aware StAX-compliant (JSR-173) Open Source XML-processor written in Java. XML processor means that it handles both input (== parsing) and output (== writing, serialization)), as well as supporting tasks such as validation. Security Fix(es): Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.(CVE-2022-40152)

openSUSE-SU-2024:13150-1 — jackson-dataformat-xml-2.15.2-1.1 on GA media

jackson-dataformat-xml-2.15.2-1.1 on GA media

RHSA-2023:0469 — Red Hat Security Advisory: Red Hat Integration Camel Extensions For Quarkus 2.13.2

jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays apache-commons-text: variable interpolation RCE

SUSE-SU-2023:0592-1 — Security update for SUSE Manager Server 4.2

Security update for SUSE Manager Server 4.2

UBUNTU-CVE-2022-40152

Affected: Ubuntu:Pro:14.04:LTS: libxstream-java, Ubuntu:Pro:16.04:LTS: libxstream-java, Ubuntu:18.04:LTS: libxstream-java, Ubuntu:20.04:LTS: libxstream-java, Ubuntu:22.04:LTS: libxstream-java, Ubuntu:24.04:LTS: libxstream-java, Ubuntu:25.10: libxstream-java, Ubuntu:26.04:LTS: libxstream-java

WID-SEC-W-2023-0209 — Red Hat Integration Camel Extensions for Quarkus: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Integration Camel Extensions for Quarkus ausnutzen, um einen Denial of Service Angriff durchzuführen.