EUVD-2024-52047

Malicious code in bioql PyPI...

EUVD-2025-9159

Malicious code in bioql PyPI...

EUVD-2025-8158

Malicious code in bioql PyPI...

EUVD-2023-49325

Malicious code in bioql PyPI...

PT-2025-42414

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447480433 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::bit util::BitReader::GetBatch auto arrow::util::RleBitPackedDecoder::GetBatch std:: 1::pair arrow::util::R...

arrow:parquet-arrow-fuzz: Heap-buffer-overflow in int arrow::bit_util::BitReader::GetBatch<int>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4577763874111488 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

Linux Distros Unpatched Vulnerability : CVE-2022-4245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means...

Friday Squid Blogging: A Case of Squid Fossil Misidentification

What scientists thought were squid fossils were actually arrow worms...

arrow:parquet-arrow-fuzz: Heap-buffer-overflow in parquet::DeltaByteArrayDecoderImpl<parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5504019512754176 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x50a000000240 Crash...

arrow:parquet-arrow-fuzz: Use-after-poison in parquet::PlainDecoder<parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6414751523733504 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Use-after-poison READ Crash Address: 0x7f6cb7df6174 Crash State...

SUSE CVE-2025-49011

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow'ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, reques...

arrow:parquet-arrow-fuzz: Use-after-poison in parquet::PlainDecoder<parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5843248142942208 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Use-after-poison READ Crash Address: 0x7cb137df615b Crash State...

SpiceDB 安全特征问题漏洞

SpiceDB is a fine-grained permissions database from the Authzed team. A security feature issue vulnerability exists in SpiceDB versions prior to 1.44.2, which stems from a schema evaluation issue involving arrow relationships that could result in an incorrect response...

arrow:parquet-arrow-fuzz: Bad-cast to typename shared_ptr<TypedStatistics<PhysicalType<parquet::Type::DOUBLE>>>::element_type' (aka 'parquet::TypedStatistics<parquet::PhysicalType<parquet::Type::DOUBLE>>') from parquet::(anonymous namespace)::TypedStatisticsImpl<parquet::PhysicalType<(parquet::Type::type)2>> in std::__1::shared_ptr<parquet::TypedStatistics<parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5638988460785664 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: Bad-cast Crash Address: 0x56c0f7c9db98 Crash State...

GHSA-WV8J-M3HX-924J Arrow2 allows out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

CVE-2024-52338

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2023-44264

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...

CVE-2023-45003

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin = 2.2.0 versions...

CVE-2023-46077

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...

CVE-2019-12410

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...