EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2022-2615)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, whe...

Input validation

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4HdlrAtom::AP4HdlrAtom which allows attackers to cause a Denial of Service DoS via a crafted input...

UBUNTU-CVE-2022-43033

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4HdlrAtom::AP4HdlrAtom which allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2022-43033

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4HdlrAtom::AP4HdlrAtom which allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2022-26717 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: An issue in the component AP4 HdlrAtom::AP4 HdlrAtom allows attackers to cause a Denial of Service DoS via a crafted input. This is due to a bad free, which can be exploited to disrupt the service...

CVE-2022-2908

GitLab CVE-2022-2908 affects GitLab CE/EE: DoS via crafted input in the Commit message field causing high CPU. Affected: GitLab versions starting from 10.7 up to 15.1.5, 15.2 up to 15.2.3, and 15.3 up to 15.3.1. Patches exist in 15.1.5, 15.2.3, and 15.3.1 releases; upgrade to these fixed builds w...

CVE-2022-2908

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit messag...

Huawei EulerOS: Security Advisory for gmp (EulerOS-SA-2022-2502)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

OESA-2022-1935 libtiff security update

This libtiff provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libti...

Buffer Overflow

fis-gtm is vulnerable to buffer overflow. The vulnerability exist inutilformat function in utilouput.c where the attacker can control the size of the memset by using a crafted input...

NULL Pointer Dereference

fis-gtm is vulnerable to null pointer difference. The vulnerability exist in FIS GT.M where the attacker uses a crafted input to causa a call to ZREAD to crash...

Denial Of Service (DoS)

fis-gtm is vulnerable to denial of service. The vulnerability exists due to an integer underflow of the size of calls to memset in opfnj3 in srport/opfnj3.c which allows an attacker to cause a segmentation fault and crash the application using crafted input...

OESA-2022-1916 libjpeg-turbo security update

libjpeg-turbo is a JPEG image codec that uses SIMD instructions MMX, SSE2, NEON, AltiVec to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems. Security Fixes: A crafted input file could cause a null pointer dereference in jcopysamplerows when processed by...

OESA-2022-1915 libjpeg-turbo security update

libjpeg-turbo is a JPEG image codec that uses SIMD instructions MMX, SSE2, NEON, AltiVec to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems. Security Fixes: A crafted input file could cause a null pointer dereference in jcopysamplerows when processed by...

UBUNTU-CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi leading to a crash and causing a denial of service.

...

lz4: memory corruption due to an integer overflow bug caused by memmove argument

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability...

CVE-2022-2980

A NULL pointer dereference vulnerability was found in vim's domouse function of the src/mouse.c file. The issue occurs with a mouse click when it is not initialized. This flaw allows an attacker to trick a user into opening a specially crafted input file, triggering the vulnerability that could...

Denial Of Service (DoS)

libtiff.so is vulnerable to denial of service. The vulnerability exists in rotateImage function in tiffcrop.c due to a memory corruption occurs during memory allocation into buffer which allows an attacker to cause an application crash via a crafted input...