CVE-2021-43391: Out-of-bounds Read

An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file an invalid dash counter in line types can trigger a read past the end of an allocated...

PT-2021-23826 · Open Design Alliance · Open Design Alliance Drawings Sdk

Name of the Vulnerable Software and Affected Versions: Open Design Alliance Drawings SDK versions prior to 2022.11 Description: The issue exists within the parsing of DXF files, where crafted data can trigger a read past the end of an allocated buffer, allowing an attacker to execute code in the...

CLSA-2021-1632262065 Update of nscd, glibc-headers, glibc, glibc-utils, glibc-static, glibc-static, glibc-devel, glibc-devel, glibc, glibc-common

More precise DNS name checks accepting dash-.example.com, among other things...

The vulnerability of the `open_generic_xdg_mime` function in the xdg-open component of the Xdg-utils suite, a set of tools for integrating applications into the Xdg environment, arises due to insufficient handling of input data cleaning. This vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the opengenericxdgmime function in the xdg-open component, a toolset for integrating applications into the Xdg environment, is related to incorrect handling of local variables when using the dash library. Exploiting this vulnerability can allow an attacker to gain access to...

DEBIAN-CVE-2021-38185

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is...

UBUNTU-CVE-2020-22352

The gfdashsegmenterprobeinput function in GPAC v0.8 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

GPAC 代码问题漏洞

GPAC is an open source multimedia framework. gfdashsegmenterprobeinput function in GPAC version 0.8 has a null pointer dereference vulnerability that can be exploited by attackers to cause a denial of service via a specially crafted file in the MP4Box command...

AZL-6566 CVE-2021-34556 affecting package kernel for versions less than 5.10.78.1-1

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack...

SUSE: Security Advisory (SUSE-SU-2020:3480-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-1877: Improper Neutralization of Special Elements used in a Command

The opengenericxdgmime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file...

CVE-2021-31323

Telegram Android 7.1.0 2090, Telegram iOS 7.1, and Telegram macOS 7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via ...

Telegram 缓冲区错误漏洞

Telegram is an instant messaging mobile application. A heap buffer overflow vulnerability exists in the custom derived LottieParserImpl :: parseDashProperty function of the rlottie library in Telegram for Android prior to version 7.1.0 2090, iOS prior to version 7.1, and macOS prior to version 7....

Updated dash packages fix a security vulnerability

Code was executed even if noexec "-n" was specified. bdo58288 / bsc1178978...

MGASA-2021-0006 Updated dash packages fix a security vulnerability

Code was executed even if noexec "-n" was specified. bdo58288 / bsc1178978...

chewb-server (>=0.0.1, <=0.0.20), video-dash-uploader (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2020-28436 via google-cloudstorage-commands (0.0.1)

google-cloudstorage-commands NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on google-cloudstorage-commands and may be impacted: - chewb-server =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2020-28436 Source advisory:...

CVE-2020-35650

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

Uncanny Owl Groups for LearnDash Cross-Site Scripting Vulnerability

Uncanny Owl Groups for LearnDash is a plugin from Uncanny Owl Canada that provides the ability to sell courses for LearnDash in Wordpress. A cross-site scripting vulnerability exists in Uncanny Groups for LearnDash versions prior to v3.7, which allows an authenticated, remote attacker to inject...

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

...

SUSE SLED15 / SLES15 Security Update : dash (SUSE-SU-2020:3480-1)

This update for dash fixes the following issues : Fixed an issue where code was executed even if noexec '-n' was specified bsc1178978. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

openSUSE Security Update : dash (openSUSE-2020-2065)

This update for dash fixes the following issues : - Fixed an issue where code was executed even if noexec '-n' was specified bsc1178978. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...