Allele Security Intelligence - Memory Exhaustion

ASA-2019-00641 – Linux kernel: Memory leak in af9005_identify_state()

Posted on November 26, 2019December 10, 2019 by Allele Security Intelligence in Alerts

A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel allows attackers to cause a denial of service (memory consumption).

ASA-2019-00473 – Mikrotik RouterOS: Memory exhaustion via a crafted POST request

Posted on July 26, 2019November 30, 2020 by Allele Security Intelligence in Alerts

This vulnerability is similar to the CVE-2018-1157. An authenticated user can cause the www binary to consume all memory via a crafted POST request to /jsproxy/upload. It's because of the incomplete fix for the CVE-2018-1157.

ASA-2019-00074 – Django: Memory exhaustion in utils.numberformat.format()

Posted on February 12, 2019June 3, 2019 by Allele Security Intelligence in Alerts

If django.utils.numberformat.format() -- used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters -- received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format().