Open Source Vulnerabilities

ghostscript

trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command

k3s

Kubernetes kube-apiserver in versions v1

bind

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc

ghostscript

In Artifex Ghostscript through 10

k3s

Kubernetes kubelet component in versions 1

bind

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an asserti...

ghostscript

issue was discovered in Artifex Ghostscript before 10

bind

query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate

k3s

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows

flac

error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder

ghostscript

issue was discovered in Artifex Ghostscript before 10

bind

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named

k3s

In containerd (an industry-standard container runtime) before versions 1

flac

In append_to_verify_fifo_interleaved_ of stream_encoder

ghostscript

issue was discovered in Artifex Ghostscript before 10

bind

error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession

k3s

security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook

flac

In FLAC__bitreader_read_rice_signed_block of bitreader

ghostscript

Artifex Ghostscript before 10

bind

problem with the implementation of the new serve-stale feature in BIND 9

k3s

runc before 1

pulumi-language-nodejs, pulumi-language-nodejs

pulumi-language-nodejs, pulumi-language-nodejs

ghostscript

issue was discovered in Artifex Ghostscript before 10

bind

Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nam...

k3s

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority privat...

ghostscript

issue was discovered in psi/zfile

bind

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model us...

nodetaint, k3s

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers

ghostscript

issue was discovered in psi/zcolor

bind

failure to free memory can occur when processing messages having a specific combination of EDNS options

k3s

Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service

ghostscript

issue was discovered in decode_utf8 in base/gp_utf8

bind

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation

ghostscript

issue was discovered in base/gsdevice

bind

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9

ghostscript

issue was discovered in pdf/pdf_xref

bind

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time

k3s

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go

ghostscript

issue was discovered in psi/zcolor

bind

programming error in the nxdomain-redirect feature can cause an assertion failure in query

py3.13-urllib3, py3.10-urllib3, py3.11-urllib3, py3.12-urllib3

urllib3 library 1

bind

race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch

py3.13-urllib3, py3.10-urllib3, py3.11-urllib3, py3.12-urllib3

urllib3 before 1

bind

defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query

py3.13-urllib3, py3.10-urllib3, py3.11-urllib3, py3.12-urllib3

urllib3 is a user-friendly HTTP client library for Python

bind

Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers

bind

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled

py3.13-urllib3, py3.10-urllib3, py3.11-urllib3, py3.12-urllib3

urllib3 is a user-friendly HTTP client library for Python

bind

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the ...