72409 matches found
nanoid: nanoid: Predictable ID generation due to integer overflow
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...
poppler: poppler: Data corruption via integer overflow in FoFiTrueType::cvtSfnts
A flaw was found in Poppler. An integer overflow vulnerability in the TrueType font handling code can allow a local user to cause data corruption. By providing a specially crafted font file processed by the FoFiTrueType::cvtSfnts function, an attacker can cause improper data modification and...
poppler: poppler: Denial of Service via integer overflow in SplashClip
A flaw was found in poppler. An integer overflow vulnerability exists in the SplashClip rendering component when handling path clipping operations. A local attacker could exploit this flaw by providing specially crafted input, causing the application to crash and resulting in a Denial of Service...
BIT-PHP-MIN-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...
BIT-PHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...
BIT-PHP-MIN-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...
BIT-PHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...
BIT-PGBOUNCER-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...
BIT-LIBPHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...
BIT-LIBPHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...
CLEANSTART-2024-SY86592 Integer overflow in Mojo in Google Chrome prior to 98
Security vulnerability affects the chromium package. Integer overflow in Mojo in Google Chrome prior to 98...
CLEANSTART-2024-QV79984 WebPImage::decodeChunks integer overflow in Exiv2 through 0
Security vulnerability affects the exiv2 package. A WebPImage::decodeChunks integer overflow in Exiv2 through 0...
CLEANSTART-2024-EI35625 CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0
Security vulnerability affects the exiv2 package. A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0...
CLEANSTART-2024-IN78831 integer overflow in Exiv2 through 0
Security vulnerability affects the exiv2 package. An integer overflow in Exiv2 through 0...
CLEANSTART-2024-WC89015 integer overflow in Exiv2 through 0
Security vulnerability affects the exiv2 package. An integer overflow in Exiv2 through 0...
thrift: thrift: Denial of Service via buffer overflow in PHP bindings
A flaw was found in Apache Thrift. An integer overflow within the PHP bindings leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker could exploit this flaw to crash the service, leading to a Denial of Service DoS...
webkit2gtk3 security update
An update is available for webkit2gtk3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list WebKitGTK is the port of the portable web rendering engine WebKit to the...
RLSA-2026:74084 Critical: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2023-4860 chromium-browser: angle: Out of bounds memory access in ANGLE CVE-2024-7532 chromium-browser:...