Skip to content

Product

debian/burp vulnerabilities

5 published CVES affecting debian/burp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
5
Critical
0
High
4
Medium
0
Low
0
Unscored
1
CISA KEV
0

Latest debian/burp CVEs

Newest publication first

  2. CVE-2022-24795 Buffer Overflow and Integer Overflow in yajl-ruby

    Published
    HighCVSS 7.5 EPSS 3.4% PoC

    yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at yajl_buf.c#L64 may res...

  3. CVE-2017-18285 The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveragin...

    Published
    HighCVSS 7.1 EPSS 0.31%

    The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.

  4. CVE-2017-18284 The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to thi...

    Published
    HighCVSS 7.1 EPSS 0.27%

    The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.

  5. CVE-2017-16516 yajl-ruby gem Denial of Service vulnerability

    Published
    HighCVSS 7.5 EPSS 3.8% PoC

    In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.