Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious qnx binary could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch for this issue.

CVE-2022-36043 is a vulnerability identified in the rizin reverse engineering framework, specifically affecting versions 0.4.0 and earlier. Rizin is a UNIX-like toolset used primarily for reverse engineering tasks, including binary analysis and debugging. The vulnerability is a double free issue (CWE-415) located in the source file bobj.c within the function rz_bin_reloc_storage_free(). This function is responsible for freeing memory allocated for relocation entries generated by the QNX binary plugin. When a user opens a specially crafted malicious QNX binary file, the double free flaw can be triggered, leading to undefined behavior such as memory corruption. This memory corruption can be exploited by an attacker to execute arbitrary code on the victim's machine. The vulnerability arises because the same memory is freed twice, which can corrupt the heap metadata and potentially allow control over the program’s execution flow. The issue was addressed in a patch committed under the identifier a3d50c1ea185f3f642f2d8180715f82d98840784. No known exploits have been reported in the wild to date, but the nature of the vulnerability means it could be leveraged in targeted attacks against users of vulnerable rizin versions. Since rizin is a specialized tool primarily used by security researchers, malware analysts, and reverse engineers, the attack surface is limited to those environments where rizin is installed and used to analyze QNX binaries. The vulnerability requires the user to open a malicious QNX binary file, so user interaction is necessary. The attack does not require authentication but depends on the victim voluntarily loading the crafted file into the tool. The vulnerability impacts the confidentiality, integrity, and availability of the affected system due to the potential for arbitrary code execution.

Detailed information about CVE-2022-36043: CWE-415: Double Free in rizinorg rizin affecting rizinorg rizin. Get real-time updates, technical details, and mitiga

CVE-2022-36043: CWE-415: Double Free in rizinorg rizin - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-36043: CWE-415: Double Free in rizinorg rizin

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be used with pointer types which may point to alterable data where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project itself has been archived and updates are not expected. Users are advised to find a replacement.

CVE-2022-23459 is a use-after-free and double-free vulnerability identified in the Jsonxx (also known as Json++) library, a C++ JSON parser, writer, and reader. The vulnerability arises from the improper handling of the Value class within Jsonxx. Specifically, the default assignment operator of the Value class can be used with pointer types that point to mutable data without updating the pointer itself. This leads to scenarios where memory may be freed multiple times (double free) or accessed after it has been freed (use after free), resulting in memory corruption. Such memory corruption can cause undefined behavior, including application crashes, data corruption, or potentially arbitrary code execution if exploited. The Jsonxx project has been archived and is no longer maintained, meaning no patches or updates are forthcoming to address this vulnerability. The affected versions are unspecified but presumed to include all versions of Jsonxx prior to archiving. No known exploits have been reported in the wild to date. Given the nature of the vulnerability, exploitation would typically require the attacker to influence or control JSON data processed by the vulnerable application, potentially requiring some level of user interaction or input injection. The vulnerability affects the confidentiality, integrity, and availability of applications using Jsonxx due to the risk of memory corruption and potential arbitrary code execution.

Detailed information about CVE-2022-23459: CWE-416 Use After Free in hjiang Jsonxx affecting hjiang Jsonxx. Get real-time updates, technical details, and mitiga

CVE-2022-23459: CWE-416 Use After Free in hjiang Jsonxx - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23459: CWE-416 Use After Free in hjiang Jsonxx

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.

CVE-2022-31117 is a medium-severity vulnerability classified as CWE-415 (Double Free) found in UltraJSON (ujson), a high-performance JSON encoder and decoder implemented in pure C with Python bindings for versions 3.7 and above. The vulnerability affects UltraJSON versions prior to 5.4.0. Specifically, the issue arises during the reallocation of a buffer used for string decoding. If an error occurs during this reallocation, the buffer may be freed twice, leading to a double free condition. Double free vulnerabilities can cause undefined behavior including memory corruption, application crashes, or potentially arbitrary code execution depending on the context and memory layout. However, in this case, the internal design of UltraJSON's decoder prevents this double free from being triggered directly through Python bindings, limiting the exploitability from typical Python application usage. The vulnerability was publicly disclosed on July 5, 2022, and has been resolved in UltraJSON version 5.4.0. There are currently no known exploits in the wild, and no workarounds exist aside from upgrading to the patched version. The vulnerability does not have a CVSS score assigned but is considered medium severity based on the nature of the flaw and its limited exploitability vector. UltraJSON is commonly used in Python applications requiring fast JSON parsing and encoding, including web services, data processing pipelines, and other software components that handle JSON data at scale.

Detailed information about CVE-2022-31117: CWE-415: Double Free in ultrajson ultrajson affecting ultrajson ultrajson. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-415-double-free'

Filter Threats

Threats Tagged 'cwe-415-double-free'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility