GHSA-J66Q-QMRC-89RX jsonpickle unsafe deserialization

jsonpickle through 1.4.2 allows remote code execution during deserialization of a malicious payload through the decode function. This CVE is disputed by the project author as intended functionality...

GHSA-R7RM-8J6H-R933 Buffer Copy without Checking Size of Input in Pillow

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow...

DEBIAN-CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2021-42586

A heap buffer overflow was discovered in copybytes in decoder2007.c in dwgread before 0.12.4 via a crafted dwg file...

CVE-2021-42585

A heap buffer overflow was discovered in copycompressedbytes in decoder2007.c in dwgread before 0.12.4 via a crafted dwg file...

GNU LibreDWG buffer error vulnerability

GNU LibreDWG is a C library for processing DWG files from the GNU community.A heap buffer overflow vulnerability exists in versions of GNU LibreDWG prior to 0.12.4, which stems from a boundary error in copybytes of decoder2007.c when handling untrusted input. No detailed vulnerability details are...

PT-2022-11627

Name of the Vulnerable Software and Affected Versions dwgread versions prior to 0.12.4 Description A heap buffer overflow was discovered in the copy bytes function in decode r2007.c via a crafted dwg file. Recommendations For versions prior to 0.12.4, update to version 0.12.4 or later to resolve...

PT-2022-11626

Name of the Vulnerable Software and Affected Versions dwgread versions prior to 0.12.4 Description A heap buffer overflow was discovered in the copy compressed bytes function in decode r2007.c via a crafted dwg file. Recommendations For versions prior to 0.12.4, update to version 0.12.4 or later ...

GNU LibreDWG buffer error vulnerability

GNU LibreDWG is a C library for processing DWG files from the GNU community.A heap buffer overflow vulnerability exists in versions of GNU LibreDWG prior to 0.12.4, which stems from a boundary error in copycompressedbytes of decoder2007.c when handling untrusted input. No detailed vulnerability...

PT-2022-36993

Name of the Vulnerable Software and Affected Versions OpenJPEG affected versions not specified Description A heap buffer overflow issue has been identified, which can cause a crash. The crash occurs due to a write operation. Technical details about the crash include the functions opj t1 allocate...

Updated golang packages fix security vulnerability

encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash CVE-2022-24675 crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or...

AZL-9734 CVE-2022-1623 affecting package libtiff for versions less than 4.4.0-1

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tiflzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa...

DEBIAN-CVE-2022-1622

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tiflzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa...

Libsixel security vulnerabilities

libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. libsixel img2sixel version 1.8.6 is vulnerable to a denial-of-service vulnerability, which stems from an assertion failure error in stbijpeghuffdecode, stbimage.h:1894 . A...

PT-2022-19939

Name of the Vulnerable Software and Affected Versions libsixel img2sixel version 1.8.6 Description The issue is related to an assertion failure error in stbi jpeg huff decode at stb image.h:1894. This error can be triggered by remote attackers using a crafted JPEG file, potentially causing a...

PT-2022-36986

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-use-after-free READ 8 crash has been reported. The crash state includes function calls such as dwg add handleref, dwg add STYLE, and decode preR13...

cbor-java:FuzzDec: Uncaught exception in java.base/java.io.ByteArrayOutputStream.<init>

Detailed Report: https://oss-fuzz.com/testcase?key=5869144274239488 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.io.ByteArrayOutputStream...

PT-2022-18790

Name of the Vulnerable Software and Affected Versions Libarchive version 3.6.0 Description A read memory access issue was discovered in Libarchive via the lzma decode function. Recommendations For Libarchive version 3.6.0, as a temporary workaround, consider disabling the lzma decode function unt...

CVE-2021-46440

Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to...

CVE-2021-46440

Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to...