CVE-2022-1284
published 2022-04-08CVE-2022-1284: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
PriorityP418medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.80%
52.7th percentile
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| conduit-hyper_project | conduit-hyper | >= 0.2.0-alpha.3 < 0.4.2 | 0.4.2 |
| debian | radare2 | < radare2 5.9.0+dfsg-1 (sid) | radare2 5.9.0+dfsg-1 (sid) |
| dolibarr | dolibarr | >= 0 < 15.0.0 | 15.0.0 |
| dolibarr | dolibarr | >= 0 < 15.0 | 15.0 |
| gitlab | gitlab | — | — |
| gitlab | gitlab_ce | — | — |
| intel | optimization_for_tensorflow | >= 0 < 2.6.4 | 2.6.4 |
| intel | optimization_for_tensorflow | >= 0 < 2.8.4 | 2.8.4 |
| intel | optimization_for_tensorflow | >= 0 < 2.5.3 | 2.5.3 |
| intel | optimization_for_tensorflow | >= 2.10.0 < 2.10.1 | 2.10.1 |
| intel | optimization_for_tensorflow | >= 2.6.0 < 2.6.3 | 2.6.3 |
| intel | optimization_for_tensorflow | >= 2.7.0 < 2.7.2 | 2.7.2 |
| intel | optimization_for_tensorflow | >= 2.7.0 < 2.7.1 | 2.7.1 |
| intel | optimization_for_tensorflow | >= 2.8.0 < 2.8.1 | 2.8.1 |
| intel | optimization_for_tensorflow | >= 2.9.0 < 2.9.3 | 2.9.3 |
| istio.io | istio | >= 0 < 1.11.7 | 1.11.7 |
| istio.io | istio | >= 1.12.0 < 1.12.4 | 1.12.4 |
| istio.io | istio | >= 1.13.0 < 1.13.1 | 1.13.1 |
| juniper | junos_os | — | — |
| microweber | microweber | >= 0 < 1.2.11 | 1.2.11 |
| msrc | azl3_grpc_1.42.0-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_grpc_1.62.0-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_rubygem-mini_portile2_2.8.4-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_msrc8.6HIGH
vendor_redhat7.8HIGH
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ext2: Add sanity checks for group and filesystem size
vendor_redhat·2025-12-30·CVSS 5.5
CVE-2022-50815 [LOW] CWE-1284 kernel: ext2: Add sanity checks for group and filesystem size
kernel: ext2: Add sanity checks for group and filesystem size
In the Linux kernel, the following vulnerability has been resolved:
ext2: Add sanity checks for group and filesystem size
Add sanity check that filesystem size does not exceed the underlying
device size and that group size is big enough so that metadata can fit
into it. This avoid trying to mount some crafted filesystems with
extremely large group counts.
A flaw was found in the Linux kernel's ext2 filesystem implementation. The filesystem mount code lacks proper validation of filesystem size against the underlying device size and group size against metadata requirements. This allows specially crafted ext2 filesystem images with extremely large group counts to be mounted, potentially causing resource exhaustion or kernel crash
Red Hat
kernel: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
vendor_redhat·2025-09-15·CVSS 5.5
CVE-2022-50313 [MEDIUM] CWE-1284 kernel: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
kernel: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
As syzbot reported [1], the root cause is that i_size field is a
signed type, and negative i_size is also less than EROFS_BLKSIZ.
As a consequence, it's handled as fast symlink unexpectedly.
Let's fall back to the generic path to deal with such unusual i_size.
[1] https://lore.kernel.org/r/[email protected]
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Packa
Red Hat
kernel: ext4: avoid resizing to a partial cluster size
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50020 [MEDIUM] CWE-1284 kernel: ext4: avoid resizing to a partial cluster size
kernel: ext4: avoid resizing to a partial cluster size
In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid resizing to a partial cluster size
This patch avoids an attempt to resize the filesystem to an
unaligned cluster boundary. An online resize to a size that is not
integral to cluster size results in the last iteration attempting to
grow the fs by a negative amount, which trips a BUG_ON and leaves the fs
with a corrupted in-memory superblock.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 9) - Affected
Red Hat
kernel: Linux kernel: Denial of Service in ext2 filesystem via corrupted inode counts
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50205 [MEDIUM] CWE-1284 kernel: Linux kernel: Denial of Service in ext2 filesystem via corrupted inode counts
kernel: Linux kernel: Denial of Service in ext2 filesystem via corrupted inode counts
In the Linux kernel, the following vulnerability has been resolved:
ext2: Add more validity checks for inode counts
Add checks verifying number of inodes stored in the superblock matches
the number computed from number of inodes per group. Also verify we have
at least one block worth of inodes per group. This prevents crashes on
corrupted filesystems.
A flaw was found in the Linux kernel's ext2 filesystem. A local attacker could exploit this vulnerability by providing a specially crafted or corrupted filesystem with invalid inode counts. This could lead to system crashes, resulting in a Denial of Service (DoS) for the affected system.
Mitigation: Mitigation for this issue is either not available or the
Red Hat
kernel: cifs: Fix memory leak on the deferred close
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50076 [MEDIUM] kernel: cifs: Fix memory leak on the deferred close
kernel: cifs: Fix memory leak on the deferred close
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix memory leak on the deferred close
xfstests on smb21 report kmemleak as below:
unreferenced object 0xffff8881767d6200 (size 64):
comm "xfs_io", pid 1284, jiffies 4294777434 (age 20.789s)
hex dump (first 32 bytes):
80 5a d0 11 81 88 ff ff 78 8a aa 63 81 88 ff ff .Z......x..c....
00 71 99 76 81 88 ff ff 00 00 00 00 00 00 00 00 .q.v............
backtrace:
[] cifs_close+0x92/0x2c0
[] __fput+0xff/0x3f0
[] task_work_run+0x85/0xc0
[] do_exit+0x5e5/0x1240
[] do_group_exit+0x58/0xe0
[] __x64_sys_exit_group+0x28/0x30
[] do_syscall_64+0x35/0x80
[] entry_SYSCALL_64_after_hwframe+0x46/0xb0
When cancel the deferred close work, we should also cleanup the struct
cifs_deferred_c
Microsoft
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string which allows a possible arbitrary length stack overflow. This issue may cause a d
vendor_msrc·2023-03-14·CVSS 8.6
CVE-2022-4904 [HIGH] CWE-1284 A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string which allows a possible arbitrary length stack overflow. This issue may cause a d
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more informati
GitLab
CVE-2022-3411: A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authe
vendor_gitlab·2023-02-13·CVSS 6.5
CVE-2022-3411 [MEDIUM] CWE-1284 CVE-2022-3411: A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authe
CVE-2022-3411: A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
Microsoft
`tf.raw_ops.Mfcc` crashes in Tensorflow
vendor_msrc·2022-11-08·CVSS 7.5
CVE-2022-41896 [MEDIUM] CWE-1284 `tf.raw_ops.Mfcc` crashes in Tensorflow
`tf.raw_ops.Mfcc` crashes in Tensorflow
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft
GitLab
CVE-2022-2592: A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.
vendor_gitlab·2022-10-17·CVSS 6.5
CVE-2022-2592 [MEDIUM] CWE-1284 CVE-2022-2592: A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.
CVE-2022-2592: A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potential leading to Denial of Service.
Microsoft
Improper Validation of Specified Quantity in Input in vim/vim
vendor_msrc·2022-08-09·CVSS 7.8
CVE-2022-2845 [HIGH] CWE-1284 Improper Validation of Specified Quantity in Input in vim/vim
Improper Validation of Specified Quantity in Input in vim/vim
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
@huntrdev: @huntrdev
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference:
Microsoft
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
vendor_msrc·2022-08-09·CVSS 5.5
CVE-2022-2868 [MEDIUM] CWE-1284 libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to ref
Microsoft
Buffer overflow in TCP syslog server (receiver) components in rsyslog
vendor_msrc·2022-05-10·CVSS 8.1
CVE-2022-24903 [HIGH] CWE-1284 Buffer overflow in TCP syslog server (receiver) components in rsyslog
Buffer overflow in TCP syslog server (receiver) components in rsyslog
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Refe
GitLab
CVE-2022-1174: A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions
vendor_gitlab·2022-04-04·CVSS 4.3
CVE-2022-1174 [MEDIUM] CWE-1284 CVE-2022-1174: A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions
CVE-2022-1174: A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc.
Microsoft
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain
vendor_msrc·2022-02-08·CVSS 5.5
CVE-2022-25375 [MEDIUM] CWE-1284 An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional p
Red Hat
frrouting: overflow bugs in unpack_tlv_router_cap
vendor_redhat·2022-02-06·CVSS 7.8
CVE-2022-26125 [HIGH] CWE-1284 frrouting: overflow bugs in unpack_tlv_router_cap
frrouting: overflow bugs in unpack_tlv_router_cap
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.
frrouting is vulnerable to a flaw that can cause buffer overflow through due to incorrect checks on the input packet length when processing type-length-value packets. There is high impact to availability due to the fact that the process up-time can be made unreliable.
Package: frr (Red Hat Enterprise Linux 8) - Will not fix
Red Hat
frrouting: Heap buffer overflow in function babel_packet_examin in babeld/message.c
vendor_redhat·2022-02-04·CVSS 7.8
CVE-2022-26128 [HIGH] CWE-1284 frrouting: Heap buffer overflow in function babel_packet_examin in babeld/message.c
frrouting: Heap buffer overflow in function babel_packet_examin in babeld/message.c
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.
Package: frr (Red Hat Enterprise Linux 8) - Not affected
Package: frr (Red Hat Enterprise Linux 9) - Not affected
Red Hat
frrouting: Heap buffer overflow in frr/babeld/message.c
vendor_redhat·2022-02-02·CVSS 7.8
CVE-2022-26127 [HIGH] CWE-1284 frrouting: Heap buffer overflow in frr/babeld/message.c
frrouting: Heap buffer overflow in frr/babeld/message.c
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.
Package: frr (Red Hat Enterprise Linux 8) - Not affected
Package: frr (Red Hat Enterprise Linux 9) - Not affected
Juniper
CVE-2022-22166: An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an unauth
vendor_juniper·2022-01-19·CVSS 6.5
CVE-2022-22166 [MEDIUM] CWE-1284 CVE-2022-22166: An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an unauth
CVE-2022-22166: An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause an rdp crash and thereby a Denial of Service (DoS). If a BGP update message is received over an established BGP session where a BGP SR-TE policy tunnel attribute is malformed and BGP update tracing flag is enabled, the rpd will core. This issue can happen with any BGP session as long as the previous conditions are met. This issue can not propagate as the crash occurs as soon as the malformed update is received. This issue affects Juniper Networks Junos OS: 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R2-S2, 21.1R3. This issue does not affect Juniper Networks Junos OS versio
Debian
CVE-2022-1284: radare2 - heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This ...
vendor_debian·2022·CVSS 5.5
CVE-2022-1284 [MEDIUM] CVE-2022-1284: radare2 - heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This ...
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Scope: local
sid: resolved (fixed in 5.9.0+dfsg-1)
Red Hat
libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits()
vendor_redhat·2021-12-08·CVSS 5.5
CVE-2022-2868 [MEDIUM] CWE-1284 libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits()
libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits()
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
An improper input validation flaw was found in libtiff's tiffcrop utility. This issue can lead to an out-of-bounds read and cause a crash if an attacker can supply a crafted file to tiffcrop.
Statement: This flaw is present in the tiffcrop tool only and not in the libtiff library code.
Package: libtiff (Red Hat Enterprise Linux 6) - Out of support scope
Package: compat-libtiff3 (Red Hat Enterprise Linux 7) - Out of support scope
Package: libtiff (Red Hat Enterprise Linux 7) - Out of support s
GHSA
ToolJet is vulnerable to Denial of Service (DoS)
ghsa·2022-11-22
CVE-2022-4111 [MEDIUM] CWE-1284 ToolJet is vulnerable to Denial of Service (DoS)
ToolJet is vulnerable to Denial of Service (DoS)
ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0.
`tooljet` is no longer listed on npmjs.com but was [listed on npmjs.com in the past](https://web.archive.org/web/20220210014826/https://www.npmjs.com/package/tooljet). This advisory is maintained for historical completeness.
GHSA
`tf.raw_ops.Mfcc` crashes
ghsa·2022-11-21
CVE-2022-41896 [MEDIUM] CWE-1284 `tf.raw_ops.Mfcc` crashes
`tf.raw_ops.Mfcc` crashes
### Impact
If [`ThreadUnsafeUnigramCandidateSampler`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc) is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash.
```python
import tensorflow as tf
tf.raw_ops.Mfcc(
spectrogram = [[[1.38, 6.32, 5.75, 9.51]]],
sample_rate = 2,
upper_frequency_limit = 5.0,
lower_frequency_limit = 1.0,
filterbank_channel_count = 2**31 - 1,
dct_coefficient_count = 1
)
```
### Patches
We have patched the issue in GitHub commit [39ec7eaf1428e90c37787e5b3fbd68ebd3c48860](https://github.com/tensorflow/tensorflow/commit/39ec7eaf1428e90c37787e5b3fbd68ebd3c48860).
The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on Te
GHSA
conduit-hyper vulnerable to Denial of Service from unchecked request length
ghsa·2022-10-31
CVE-2022-39294 [HIGH] CWE-1284 conduit-hyper vulnerable to Denial of Service from unchecked request length
conduit-hyper vulnerable to Denial of Service from unchecked request length
Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request.
In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request").
This crate is part of the implementation of Rust's [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit
GHSA
parse-server crashes when receiving file download request with invalid byte range
ghsa·2022-10-18
CVE-2022-39313 [HIGH] CWE-1284 parse-server crashes when receiving file download request with invalid byte range
parse-server crashes when receiving file download request with invalid byte range
### Impact
Parse Server crashes when a file download request is received with an invalid byte range.
### Patches
Improved parsing of the range parameter to properly handle invalid range requests.
### Workarounds
None
### References
- [GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)
GHSA
Missing validation causes denial of service via `LSTMBlockCell`
ghsa·2022-05-24
CVE-2022-29200 [MEDIUM] CWE-1284 Missing validation causes denial of service via `LSTMBlockCell`
Missing validation causes denial of service via `LSTMBlockCell`
### Impact
The implementation of [`tf.raw_ops.LSTMBlockCell`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/rnn/lstm_ops.cc) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:
```python
import tensorflow as tf
tf.raw_ops.LSTMBlockCell(
x=tf.constant(0.837607, shape=[28,29], dtype=tf.float32),
cs_prev=tf.constant(0, shape=[28,17], dtype=tf.float32),
h_prev=tf.constant(0.592631638, shape=[28,17], dtype=tf.float32),
w=tf.constant(0.887386262, shape=[46,68], dtype=tf.float32),
wci=tf.constant(0, shape=[], dtype=tf.float32),
wcf=tf.constant(0, shape=[17], dtype=tf.float32),
wco=tf.
GHSA
Missing validation causes denial of service via `Conv3DBackpropFilterV2`
ghsa·2022-05-24
CVE-2022-29196 [MEDIUM] CWE-1284 Missing validation causes denial of service via `Conv3DBackpropFilterV2`
Missing validation causes denial of service via `Conv3DBackpropFilterV2`
### Impact
The implementation of [`tf.raw_ops.Conv3DBackpropFilterV2`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/conv_grad_ops_3d.cc) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:
```python
import tensorflow as tf
tf.raw_ops.Conv3DBackpropFilterV2(
input=tf.constant(.5053710941, shape=[2,2,2,2,1], dtype=tf.float16),
filter_sizes=tf.constant(0, shape=[], dtype=tf.int32),
out_backprop=tf.constant(.5053710941, shape=[2,2,2,2,1], dtype=tf.float16),
strides=[1, 1, 1, 1, 1],
padding="VALID",
data_format="NDHWC",
dilations=[1, 1, 1, 1, 1])
```
The code does not val
GHSA
Denial of service in `tf.ragged.constant` due to lack of validation
ghsa·2022-05-24
CVE-2022-29202 [MEDIUM] CWE-1284 Denial of service in `tf.ragged.constant` due to lack of validation
Denial of service in `tf.ragged.constant` due to lack of validation
### Impact
The implementation of [`tf.ragged.constant`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/ops/ragged/ragged_factory_ops.py#L146-L239) does not fully validate the input arguments. This results in a denial of service by consuming all available memory:
```python
import tensorflow as tf
tf.ragged.constant(pylist=[],ragged_rank=8968073515812833920)
```
### Patches
We have patched the issue in GitHub commit [bd4d5583ff9c8df26d47a23e508208844297310e](https://github.com/tensorflow/tensorflow/commit/bd4d5583ff9c8df26d47a23e508208844297310e).
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.
GHSA
GHSA-jxwm-2fgw-85f5: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5
ghsa_unreviewed·2022-04-09
CVE-2022-1284 [MEDIUM] CWE-416 GHSA-jxwm-2fgw-85f5: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
OSV
CVE-2022-1284: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5
osv·2022-04-08·CVSS 5.5
CVE-2022-1284 [MEDIUM] CVE-2022-1284: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
GHSA
Unauthenticated control plane denial of service attack in Istio
ghsa·2022-02-23
CVE-2022-23635 [HIGH] CWE-1284 Unauthenticated control plane denial of service attack in Istio
Unauthenticated control plane denial of service attack in Istio
### Impact
The Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker.
For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet.
### Patches
- Istio 1.13.1 and above
- Istio 1.12.4 and above
- Istio 1.11.7 and above
### Workarounds
There are no effe
GHSA
Microweber vulnerable to Improper Validation of Specified Quantity in Input
ghsa·2022-02-16
CVE-2022-0596 [MEDIUM] CWE-1284 Microweber vulnerable to Improper Validation of Specified Quantity in Input
Microweber vulnerable to Improper Validation of Specified Quantity in Input
Microweber prior to version 1.2.11 can have a negative product amount. This could allow an attacker to manipulate the total value and get products for free.
GHSA
Abort caused by allocating a vector that is too large in Tensorflow
ghsa·2022-02-07
CVE-2022-23580 [MEDIUM] CWE-1284 Abort caused by allocating a vector that is too large in Tensorflow
Abort caused by allocating a vector that is too large in Tensorflow
### Impact
During shape inference, TensorFlow can [allocate a large vector](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790) based on a value from a tensor controlled by the user:
```cc
const auto num_dims = Value(shape_dim);
std::vector dims;
dims.reserve(num_dims);
```
### Patches
We have patched the issue in GitHub commit [1361fb7e29449629e1df94d44e0427ebec8c83c7](https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and
GHSA
Dolibarr vulnerable to Improper Validation of Specified Quantity in Input
ghsa·2022-02-01
CVE-2022-0414 [MEDIUM] CWE-1284 Dolibarr vulnerable to Improper Validation of Specified Quantity in Input
Dolibarr vulnerable to Improper Validation of Specified Quantity in Input
Dolibarr 14.0.5 and prior versions are vulnerable to Improper Validation of Specified Quantity in Input.
GHSA
Logic error in dolibarr
ghsa·2022-01-12
CVE-2022-0174 [MEDIUM] CWE-1284 Logic error in dolibarr
Logic error in dolibarr
The application does not check the input of price number lead to Business Logic error through negative price amount.
No detection rules found.
No public exploits indexed.
2022-04-08
Published