4 results (0.004 seconds)

CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. Bucle con vulnerabilidad de condición de salida inalcanzable ("bucle infinito") en Apache Commons Compress. Este problema afecta a Apache Commons Compress: desde 1.3 hasta 1.25.0. Se recomienda a los usuarios actualizar a la versión 1.26.0, que soluciona el problema. A loop with an unreachable exit condition (Infinite Loop) vulnerability was found in Apache Common Compress. • http://www.openwall.com/lists/oss-security/2024/02/19/1 https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf https://security.netapp.com/advisory/ntap-20240307-0010 https://access.redhat.com/security/cve/CVE-2024-25710 https://bugzilla.redhat.com/show_bug.cgi?id=2264988 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •

CVSS: 7.5EPSS: 1%CPEs: 72EXPL: 0

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. Al leer un archivo ZIP especialmente diseñado, Compress puede asignar grandes cantidades de memoria que finalmente conllevan a un error de falta de memoria incluso para entradas muy pequeñas. Esto podría ser usado para montar un ataque de denegación de servicio contra los servicios que usan el paquete zip de Compress A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. • http://www.openwall.com/lists/oss-security/2021/07/13/4 http://www.openwall.com/lists/oss-security/2021/07/13/6 https://commons.apache.org/proper/commons-compress/security-reports.html https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache • CWE-130: Improper Handling of Length Parameter Inconsistency CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 7.5EPSS: 1%CPEs: 54EXPL: 0

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. Cuando se lee un archivo TAR especialmente diseñado, Compress puede asignar grandes cantidades de memoria que finalmente conllevan a un error de falta de memoria incluso para entradas muy pequeñas. Esto podría ser usado para montar un ataque de denegación de servicio contra servicios que usan el paquete tar de Compress A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. • http://www.openwall.com/lists/oss-security/2021/07/13/3 http://www.openwall.com/lists/oss-security/2021/07/13/5 https://commons.apache.org/proper/commons-compress/security-reports.html https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29%40%3Cissues.flink.apache.org%3E https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache& • CWE-130: Improper Handling of Length Parameter Inconsistency CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 0

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs. Vulnerabilidad de complejidad algorítmica en los algoritmos de ordenamiento de compresión de "stream" bzip2 (BZip2CompressorOutputStream) de Apache Commons Compress anteriores a 1.4.1. Permite a atacantes remotos provocar una denegación de servicio (consumo de la CPU) a través de un archivo con muchas entradas repetidas. • http://ant.apache.org/security.html http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html http://commons.apache.org/compress/security.html http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html http://osvdb.org/82161 http:// • CWE-310: Cryptographic Issues •