CVE-2025-15537 Mapnik dbfile.cpp string_value heap-based overflow

A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbffile::stringvalue of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed...

CVE-2025-15537

Mapnik up to 4.2.0 is affected by a heap-based buffer overflow in the function mapnik::dbf_file::string_value (plugins/input/shape/dbfile.cpp). The issue requires local access to exploit and has publicly disclosed exploit information. Mapnik project was informed via issue report and has not respo...

CVE-2025-15537 Mapnik dbfile.cpp string_value heap-based overflow

A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbffile::stringvalue of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed...

CVE-2025-15537 Mapnik dbfile.cpp string_value heap-based overflow

A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbffile::stringvalue of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed...

CVE-2025-15537

A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbffile::stringvalue of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed...

ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value

...

OSV-2025-1061 Security exception in org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup.<ini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431391 Crash type: Security exception Crash state: org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup. org.apache.poi.hssf.record.aggregates.SharedValueManager.create...

PT-2026-3385

A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf file::string value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclose...

ffmpeg:ffmpeg_dem_H264_fuzzer: Use-of-uninitialized-value in h264_parse

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6087031330766848 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemH264fuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

imagemagick:encoder_tiff64_fuzzer: Use-of-uninitialized-value in PixarLogDecode

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5862626268872704 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodertiff64fuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

GHSA-GW32-9RMW-QWWW svelte is vulnerable to XSS with textarea bind:value

Summary A server-side rendered with two-way bound value does not have its value correctly escaped in the rendered HTML. Details In SSR, does not have its value escaped when it is rendered into the HTML as .... PoC Put this in a server-side-rendered Svelte component: let value = test'"alert'BIM';;...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the valueDecoder function in decoder.py. An attacker can cause memory exhaustion by submitting a malformed RELATIVE-OID containing excessive continuation octets. PoC python import...

libraw:libraw_cr2_fuzzer: Use-of-uninitialized-value in LibRaw::scale_colors_loop

Detailed Report: https://oss-fuzz.com/testcase?key=5536755691618304 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::scalecolorsloop LibRaw::scalecolor...

PT-2026-5783

Уязвимость функции sub 4250E0 /boafrm/formSmsManage микропрограммного обеспечения маршрутизаторов D-Link DWR-M961 связана с непринятием мер по нейтрализации специальных элементов при обработке параметра action value. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001365)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001365 advisory. The kernelwait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a...

MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory. httpd: Improper handling of headers in modsession can allow a remote user to modify session data for CGI applications CVE-2018-1283 httpd: Out of...

MiracleLinux 7 : etcd-3.2.26-1.el7 (AXSA:2019-3901:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2019-3901:01 advisory. Security Fix - etcd RABC etcd gRPC-gateway REST API TLS RBAC Common Name CN CVE-2018-16886 CVEJVNhttp://jvndb.jvn.jp/ Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001010)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001010 advisory. Array index error in the kvmvmioctlcreatevcpu function in virt/kvm/kvmmain.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain...

mpv:fuzzer_loadfile_mkv: Use-of-uninitialized-value in ff_silk_decode_superframe

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=5068493795164160 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfilemkv Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2026-21920

An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX Series device configured for DNS processing, receives a specifically formatted DNS request flowd will...