Skip to content

Fix: Do not use macros for not setting regex flags#937

Merged
bjoernricks merged 1 commit into
mainfrom
fix-regex-flags
Jul 7, 2025
Merged

Fix: Do not use macros for not setting regex flags#937
bjoernricks merged 1 commit into
mainfrom
fix-regex-flags

Conversation

@timopollmeier
Copy link
Copy Markdown
Member

@timopollmeier timopollmeier commented Jul 7, 2025

What

Instead of using G_REGEX_DEFAULT and G_REGEX_MATCH_DEFAULT, 0 is used to indicate no flags.

Why

This is done for backward-compatibility of with older GLib versions.

@timopollmeier
Fix: Do not use macros for not setting regex flags
63033a0 
Instead of using G_REGEX_DEFAULT and G_REGEX_MATCH_DEFAULT, 0 is used to
indicate no flags.

This is done for backward-compatibility of with older GLib versions.
@timopollmeier timopollmeier requested review from a team as code owners July 7, 2025 11:41
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jul 7, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 63033a0.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jul 7, 2025 •
edited
Loading

🔍 Vulnerabilities of harbor-os.greenbone.net/community/gvm-libs:937-merge-amd64

📦 Image Reference harbor-os.greenbone.net/community/gvm-libs:937-merge-amd64
digestsha256:4a850a34ae57bbc30790b0d794533c058352cdab7edcab616e7900144fd45cba
vulnerabilitiescritical: 2 high: 4 medium: 2 low: 31
size48 MB
packages200
📦 Base Image debian:testing-20250630-slim
also known as
  • testing-slim
digestsha256:3bf8d8353cfbaacf34f1a590876a714127db8f3227fbfda1380915ed844f62cc
vulnerabilitiescritical: 0 high: 2 medium: 2 low: 17
critical: 2 high: 2 medium: 0 low: 1 libxml2 2.12.7+dfsg+really2.9.14-1 (deb)

pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-1?os_distro=trixie&os_name=debian&os_version=13

critical : CVE--2025--49796

Affected range>=2.12.7+dfsg+really2.9.14-1
Fixed versionNot Fixed
EPSS Score0.05%
EPSS Percentile16th percentile
Description

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

critical : CVE--2025--49794

Affected range>=2.12.7+dfsg+really2.9.14-1
Fixed versionNot Fixed
EPSS Score0.07%
EPSS Percentile21st percentile
Description

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

high : CVE--2025--6021

Affected range>=2.12.7+dfsg+really2.9.14-1
Fixed versionNot Fixed
EPSS Score0.05%
EPSS Percentile16th percentile
Description

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

high : CVE--2025--49795

Affected range>=2.12.7+dfsg+really2.9.14-1
Fixed versionNot Fixed
EPSS Score0.05%
EPSS Percentile16th percentile
Description

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

low : CVE--2025--6170

Affected range>=2.12.7+dfsg+really2.9.14-1
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile2nd percentile
Description

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

critical: 0 high: 1 medium: 0 low: 1 pam 1.7.0-3 (deb)

pkg:deb/debian/pam@1.7.0-3?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2025--6020

Affected range<1.7.0-5
Fixed version1.7.0-5
EPSS Score0.02%
EPSS Percentile5th percentile
Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

[experimental] - pam 1.7.0-4

low : CVE--2024--10963

Affected range<1.7.0-5
Fixed version1.7.0-5
EPSS Score0.17%
EPSS Percentile39th percentile
Description

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

critical: 0 high: 1 medium: 0 low: 0 dpkg 1.22.20 (deb)

pkg:deb/debian/dpkg@1.22.20?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2025--6297

Affected range>=1.22.20
Fixed versionNot Fixed
EPSS Score0.06%
EPSS Percentile18th percentile
Description

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.

critical: 0 high: 0 medium: 1 low: 1 perl 5.40.1-3 (deb)

pkg:deb/debian/perl@5.40.1-3?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2025--40909

Affected range>=5.40.1-3
Fixed versionNot Fixed
EPSS Score0.02%
EPSS Percentile2nd percentile
Description

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

[experimental] - perl 5.40.1-4

low : CVE--2011--4116

Affected range>=5.40.1-3
Fixed versionNot Fixed
EPSS Score0.81%
EPSS Percentile73rd percentile
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 1 low: 0 ncurses 6.5+20250216-2 (deb)

pkg:deb/debian/ncurses@6.5%2B20250216-2?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2025--6141

Affected range>=6.5+20250216-2
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile2nd percentile
Description

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.

critical: 0 high: 0 medium: 0 low: 7 glibc 2.41-9 (deb)

pkg:deb/debian/glibc@2.41-9?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2019--9192

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile38th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

low : CVE--2019--1010025

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score0.23%
EPSS Percentile46th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

low : CVE--2019--1010024

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score0.38%
EPSS Percentile58th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010023

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score0.70%
EPSS Percentile71st percentile
Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010022

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score0.14%
EPSS Percentile36th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2018--20796

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score2.00%
EPSS Percentile83rd percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.41-9
Fixed versionNot Fixed
EPSS Score0.37%
EPSS Percentile58th percentile
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

  • glibc (unimportant)
  • eglibc (unimportant)
    That's standard POSIX behaviour implemented by (e)glibc. Applications using
    glob need to impose limits for themselves
critical: 0 high: 0 medium: 0 low: 4 openldap 2.6.10+dfsg-1 (deb)

pkg:deb/debian/openldap@2.6.10%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2020--15719

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score0.37%
EPSS Percentile58th percentile
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score2.84%
EPSS Percentile86th percentile
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile31st percentile
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score1.76%
EPSS Percentile82nd percentile
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 3 krb5 1.21.3-5 (deb)

pkg:deb/debian/krb5@1.21.3-5?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--26461

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.08%
EPSS Percentile25th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.15%
EPSS Percentile37th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.46%
EPSS Percentile63rd percentile
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 libgcrypt20 1.11.0-7 (deb)

pkg:deb/debian/libgcrypt20@1.11.0-7?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--2236

Affected range>=1.11.0-7
Fixed versionNot Fixed
EPSS Score0.22%
EPSS Percentile45th percentile
Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

low : CVE--2018--6829

Affected range>=1.11.0-7
Fixed versionNot Fixed
EPSS Score1.27%
EPSS Percentile79th percentile
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 2 coreutils 9.7-3 (deb)

pkg:deb/debian/coreutils@9.7-3?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--5278

Affected range>=9.7-3
Fixed versionNot Fixed
EPSS Score0.02%
EPSS Percentile2nd percentile
Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

low : CVE--2017--18018

Affected range>=9.7-3
Fixed versionNot Fixed
EPSS Score0.06%
EPSS Percentile17th percentile
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 2 shadow 1:4.17.4-2 (deb)

pkg:deb/debian/shadow@1:4.17.4-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--56433

Affected range>=1:4.17.4-2
Fixed versionNot Fixed
EPSS Score2.87%
EPSS Percentile86th percentile
Description

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

low : CVE--2007--5686

Affected range>=1:4.17.4-2
Fixed versionNot Fixed
EPSS Score0.25%
EPSS Percentile48th percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 util-linux 2.41-5 (deb)

pkg:deb/debian/util-linux@2.41-5?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2022--0563

Affected range>=2.41-5
Fixed versionNot Fixed
EPSS Score0.03%
EPSS Percentile5th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.8.9-2 (deb)

pkg:deb/debian/gnutls28@3.8.9-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2011--3389

Affected range>=3.8.9-2
Fixed versionNot Fixed
EPSS Score5.42%
EPSS Percentile90th percentile
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 tar 1.35+dfsg-3.1 (deb)

pkg:deb/debian/tar@1.35%2Bdfsg-3.1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2005--2541

Affected range>=1.35+dfsg-3.1
Fixed versionNot Fixed
EPSS Score2.81%
EPSS Percentile85th percentile
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 0 low: 1 openssl 3.5.0-2 (deb)

pkg:deb/debian/openssl@3.5.0-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2010--0928

Affected range>=3.2.1-3
Fixed versionNot Fixed
EPSS Score0.10%
EPSS Percentile28th percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 1 hiredis 1.2.0-6 (deb)

pkg:deb/debian/hiredis@1.2.0-6?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--29479

Affected range>=1.2.0-6
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile1st percentile
Description

Buffer Overflow in hiredis 1.2.0 allows a local attacker to cause a denial of service via the sdscatlen function.

REJECTED

critical: 0 high: 0 medium: 0 low: 1 sqlite3 3.46.1-6 (deb)

pkg:deb/debian/sqlite3@3.46.1-6?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2021--45346

Affected range>=3.46.1-6
Fixed versionNot Fixed
EPSS Score0.18%
EPSS Percentile40th percentile
Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

critical: 0 high: 0 medium: 0 low: 1 glib2.0 2.84.3-1 (deb)

pkg:deb/debian/glib2.0@2.84.3-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2012--0039

Affected range>=2.84.3-1
Fixed versionNot Fixed
EPSS Score0.49%
EPSS Percentile65th percentile
Description

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.4.7-21 (deb)

pkg:deb/debian/gnupg2@2.4.7-21?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2022--3219

Affected range>=2.4.7-21
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile1st percentile
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

@bjoernricks bjoernricks merged commit 361ed44 into main Jul 7, 2025
28 checks passed
@bjoernricks bjoernricks deleted the fix-regex-flags branch July 7, 2025 11:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bjoernricks bjoernricks bjoernricks approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@timopollmeier @bjoernricks