PT-2023-6784

Name of the Vulnerable Software and Affected Versions tpm2-tss versions affected versions not specified Description The issue is related to the Tss2 RC SetHandler and Tss2 RC Decode functions in the tpm2-tss implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software...

golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service

An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to create a denial of service, impacting availability...

PT-2023-34536

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description A memory stomp issue was discovered in the decode attr security label function of NFSv4.2. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...

PT-2023-34233

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description A memory stomp issue was discovered in the decode attr security label function of NFSv4.2. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2023-33626

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.0.16 Description A potential issue exists in the media codec of the Linux Kernel, specifically in the vcodec, where it cannot set the destination buffer to done when a late decode error occurs. The actual impac...

PT-2023-34702

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.337 Description A memory stomp issue was discovered in the decode attr security label function of NFSv4.2. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2023-33940

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.87 Description The issue is related to the ksmbd decode ntlmssp auth blob function in the Linux Kernel, where the nt len is not properly checked to be at least CIFS ENCPWD SIZE. This could potentially lead ...

PT-2023-33833

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description A memory stomp issue was discovered in the decode attr security label function of NFSv4.2. The actual impact and attack plausibility have not yet been proven. This issue was introduced in...

FFmpeg code-related vulnerabilities

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A denial of service vulnerability exists in FFmpeg, which stems from a lack of return value checking in the decodemainheader function in the libavformat/nutdec.c file and triggers a null...

CVE-2022-43974

MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer overflow and achieve remote code execution. This is fixed in 4.6.0...

open62541:fuzz_json_decode: Crash in parseDouble

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6364803344236544 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6140000100...

DEBIAN-CVE-2022-41988

An information disclosure vulnerability exists in the OpenImageIO::decodeiptciim functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability...

UBUNTU-CVE-2022-41988

An information disclosure vulnerability exists in the OpenImageIO::decodeiptciim functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability...

UBUNTU-CVE-2022-3109

An issue was discovered in the FFmpeg package, where vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc and will cause a null pointer dereference, impacting availability...

PT-2022-36810

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions dwg decode INSERT private, dwg decode INSERT, and dwg decode add...

kimageformats:kimgio_heif_fuzzer: Heap-use-after-free in HEIFHandler::ensureDecoder

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=4542532443045888 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioheiffuzzer Job Type: libfuzzerasankimageformats Platform Id: linux Crash Type: Heap-use-after-free READ 3 Crash...

libredwg:llvmfuzz: Heap-buffer-overflow in bit_read_B

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4766722093875200 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2022-45332

LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decodepreR13sectionhdr at decoder11.c...

PT-2022-27471 · Libredwg · Libredwg

Name of the Vulnerable Software and Affected Versions: LibreDWG version 0.12.4.4643 Description: A heap buffer overflow issue was discovered in the decode preR13 section hdr function at decode r11.c. This issue affects the specified version of LibreDWG. Recommendations: For LibreDWG version...

Denial Of Service (DoS)

decode-uri-component is vulnerable to Denial Of Service DoS. A remote attacker is able to cause denial of service conditions via sending a malicious payload through the decode function in index.js due to improper input validation...