OL CVE Issue Summary :
out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
OL CVE Issue Summary :
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
OL CVE Issue Summary :
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
OL CVE Issue Summary :
A NULL pointer dereference flaw was found in select.c of SQLite. An out-of-memory error occurs while an early out on the INTERSECT query is processing. This flaw allows an attacker to execute a potential NULL pointer dereference.
OL CVE Issue Summary :
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error
OL CVE Issue Summary :
A flaw was found in the MiniZip component of the zlib package. When opening a new file, MiniZip doesn't properly validate the filename, comments, or extra fields length against the data type used to store this information. This may allow an attacker to craft a malicious ZIP file that will lead to an overflow on the length field. This value is further used in memory allocations and indexing, which can cause an out-of-bounds write, leading to heap corruption and possible arbitrary code execution.
OL CVE Issue Summary :
By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. The vulnerable cipher modes are ChaCha20-Poly1305 and Encrypt-then-MAC (-etm MAC algorithms). libssh2 appears to be susceptible to "Terrapin attack" where MiTM attacker is able to tamper with the SSH early protocol exchange. So libssh2 should preferably include support for "strict KEX" extension.
OL CVE Issue Summary :
Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel.
By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.
Fix is to enforce strict key exchange on client as well as on server.
OL CVE Issue Summary :
A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an uncontrolled CPU resource scenario, ultimately resulting in the server not being able to attend new requests and causing a denial of service as a consequence.
OL CVE Issue Summary :
A buffer overflow vulnerability exists in the Perl Database Interface (DBI) module versions prior to 1.643. Specifically, in the DBI.xs file, a local attacker can supply a string longer than 300 characters, leading to an out-of-bounds write. This can affect the availability of the service or compromise data integrity.
