PT-2021-6324 · Unknown +4 · Clickhouse +3

Name of the Vulnerable Software and Affected Versions: ClickHouse affected versions not specified Description: The issue is related to a heap buffer overflow in ClickHouse's LZ4 compression codec. This occurs when parsing a malicious query, as there is no verification that copy operations in the...

PT-2021-23610 · Unknown +4 · Clickhouse +3

Name of the Vulnerable Software and Affected Versions: ClickHouse affected versions not specified Description: A heap out-of-bounds read issue exists in ClickHouse's LZ4 compression codec when parsing a malicious query. The LZ4::decompressImpl loop reads a 16-bit unsigned user-supplied value offs...

PT-2021-23611 · Unknown +2 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: Clickhouse affected versions not specified Description: The issue is related to a divide-by-zero error in Clickhouse's Delta compression codec. This error occurs when parsing a malicious query, where the first byte of the compressed buffer is...

PT-2021-6323 · Unknown +2 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: ClickHouse affected versions not specified Description: The issue is related to a heap buffer overflow in ClickHouse's LZ4 compression codec. This occurs when parsing a malicious query, as there is no verification that copy operations do not...

PT-2021-23612 · Unknown +2 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: Clickhouse affected versions not specified Description: The issue is related to a divide-by-zero error in Clickhouse's DeltaDouble compression codec. This occurs when parsing a malicious query, where the first byte of the compressed buffer is...

Fixed in ClickHouse 21.10.2.15, 2021-10-18 

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopyop, ip, copyend, don’t exceed the destination buffer’s limits...

Fixed in ClickHouse 21.10.2.15, 2021-10-18​

Heap buffer overflow in ClickHouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopyop, ip, copyend, don't exceed the destination buffer's limits...

CVE-2021-42387

Heap out-of-bounds read in ClickHouse’s LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl loop, a 16-bit unsigned user-supplied value ‘offset’ is read from the compressed data. The offset is later used in the length of a copy operation, without checking the...

CVE-2021-42389

Divide-by-zero in ClickHouse’s Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. JFrog Security Research Team...

grok:grk_decompress_fuzzer: Crash in state_VLC_dec::load_bytes

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4757824941457408 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerubsangrok Platform I...

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

The plugin allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript. PoC 1 Go to Import PDF. 2 Select PDF file. 3 Set compression as 60 | calc | echo 4 Toggle import the first checkbox 5 Publish or update 6 Command executes...

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

The plugin allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript. 1 Go to Import PDF. 2 Select PDF file. 3 Set compression as 60 | calc | echo 4 Toggle import the first checkbox 5 Publish or update 6 Command executes...

CVE-2021-23044

On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the Intel QuickAssist Technology QAT compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition VE platforms, undisclose...

CVE-2021-23044

CVE-2021-23044 affects BIG-IP platforms when the Intel QuickAssist Technology (QAT) compression driver is used. The vulnerability can cause the Traffic Management Microkernel (TMM) to terminate, potentially disrupting traffic and causing DoS. Affected branches include BIG-IP 16.x prior to 16.1.0,...

PT-2021-15368

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 16.x before 16.1.0 F5 BIG-IP versions 15.1.x before 15.1.3.1 F5 BIG-IP versions 14.1.x before 14.1.4.2 F5 BIG-IP versions 13.1.x before 13.1.4.1 F5 BIG-IP versions 12.1.x and 11.6.x Description When the Intel QuickAssist...

Fedora: Security Advisory for ntfs-3g-system-compression (FEDORA-2021-38d1b07839)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for ntfs-3g-system-compression (FEDORA-2021-4dd269a76c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: ntfs-3g-system-compression-1.0-7.fc35

System compression, also known as "Compact OS", is a Windows feature that allows rarely modified files to be compressed using the XPRESS or LZX compression formats. It is not built directly into NTFS but rather is implemented using reparse points. This feature appeared in Windows 10 and it appear...

[SECURITY] Fedora 33 Update: ntfs-3g-system-compression-1.0-7.fc33

System compression, also known as "Compact OS", is a Windows feature that allows rarely modified files to be compressed using the XPRESS or LZX compression formats. It is not built directly into NTFS but rather is implemented using reparse points. This feature appeared in Windows 10 and it appear...

Fedora: Security Advisory for ntfs-3g-system-compression (FEDORA-2021-c0235d9d79)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...