| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.
The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.
A remote attacker can exhaust worker memory with a single request. |
| Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. |
| HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.
Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size.
A remote attacker can exhaust worker CPU with a few such requests. |
| HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.
The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.
A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each. |
| HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts.
The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per separator byte. The multipart parser creates a temporary file for every part that carries a filename. Neither parser limits how many fields or parts a body may hold.
A remote attacker can exhaust worker memory with a body made of separators, or create thousands of temporary files with one request of small file parts. |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally. |
| Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally. |
| RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7. |
| Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. |
| Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally. |
| Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally. |
| Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. |
