Base de CVEs

CVE-2021-37714 Alta · 7.5 CWE-835 18/08/2021

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVE-2020-27618 Média · 5.5 CWE-835 26/02/2021

Infinite Loop em Gnu Glibc

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

CVE-2020-36227 Alta · 7.5 CWE-835 26/01/2021

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the...

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

CVE-2020-13935 Alta · 7.5 CWE-835 14/07/2020

Infinite Loop em Apache Software Foundation Tomcat

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

CVE-2019-20907 Alta · 7.5 CWE-835 13/07/2020

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to...

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE-2020-7595 Alta · 7.5 CWE-835 21/01/2020

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

CVE-2018-20482 Média · 4.7 CWE-835 26/12/2018

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which...

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

CVE-2018-18700 Média · 5.5 CWE-835 29/10/2018

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31....

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

CVE-2018-14567 Média · 6.5 CWE-835 16/08/2018

Infinite Loop em Xmlsoft Libxml2

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

CVE-2017-16932 Alta · 7.5 CWE-835 23/11/2017

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.