Most recent entries from all

bdu:2023-04974

certfr-2023-avi-0701 — De multiples vulnérabilités ont été découvertes dans Splunk. Certaines d'entre elles permettent à un attaquant de provo…

certfr-2023-avi-0701

CLEANSTART-2026-BX78459 — Security fix for CVE-2023-2976 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r0, cassandra-fips 4.0.19-r3, cassan…

Affected: CleanStart: apache-hive, CleanStart: cassandra-fips, CleanStart: cassandra-reaper-fips, CleanStart: cloud-config-server, CleanStart: maven, CleanStart: spark-sc212-jdk17-py311, CleanStart: spark-sc213-jdk17-py312, CleanStart: stargate, CleanStart: strimzi-kafka-operator

CVE-2023-2976 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-270639

fkie_cve-2023-2976

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

GHSA-7g45-4rm6-3mm3 — Guava vulnerable to insecure use of temporary directory

Affected: Maven: com.google.guava:guava

Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

gsd-2023-2976

msrc_CVE-2023-2976 — Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

msrc_CVE-2023-2976

OESA-2023-1411 — guava20 security update

Affected: openEuler:20.03-LTS-SP1: guava20, openEuler:20.03-LTS-SP3: guava20, openEuler:22.03-LTS: guava20, openEuler:22.03-LTS-SP1: guava20, openEuler:22.03-LTS-SP2: guava20

Guava is a set of core libraries that includes new collection types ,immutable collections, a graph library, and utilities for concurrency, I/O, hashing, primitives, strings, and more.

Security Fix(es):

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

(CVE-2023-2976)

openSUSE-SU-2024:13001-1 — guava-32.0.1-1.1 on GA media

guava-32.0.1-1.1 on GA media

RHSA-2023:5165 — Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way SnakeYaml: Constructor Deserialization Remote Code Execution netty: world readable temporary file containing sensitive data scala: deserialization gadget chain RESTEasy: creation of insecure temp files guava: insecure temporary directory creation okio: GzipSource class improper exception handling jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies bouncycastle: potential blind LDAP injection attack using a self-signed certificate snappy-java: Integer overflow in shuffle leads to DoS snappy-java: Integer overflow in compress leads to DoS snappy-java: Unchecked chunk length leads to DoS netty: SniHandler 16MB allocation leads to OOM

SUSE-SU-2024:1138-1 — Security update for guava

Security update for guava

UBUNTU-CVE-2023-2976

Affected: Ubuntu:14.04:LTS: guava-libraries, Ubuntu:16.04:LTS: guava-libraries, Ubuntu:18.04:LTS: guava-libraries, Ubuntu:20.04:LTS: guava-libraries, Ubuntu:22.04:LTS: guava-libraries

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

WID-SEC-W-2023-1754 — IBM InfoSphere Information Server: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand zu verursachen.