CVE-2021-47039

In the Linux kernel, the following vulnerability has been resolved: ataflop: potential out of bounds in doformat The function uses "type" as an array index: q = unitdrive.disktype-queue; Unfortunately the bounds check on "type" isn't done until later in the function. Fix this by moving the bounds...

CVE-2021-46944

In the Linux kernel, the following vulnerability has been resolved: media: staging/intel-ipu3: Fix memory leak in imufmt We are losing the reference to an allocated memory if try. Change the order of the check to avoid that...

DEBIAN-CVE-2021-46944

In the Linux kernel, the following vulnerability has been resolved: media: staging/intel-ipu3: Fix memory leak in imufmt We are losing the reference to an allocated memory if try. Change the order of the check to avoid that...

CVE-2021-46943

In the Linux kernel, the following vulnerability has been resolved: media: staging/intel-ipu3: Fix setfmt error handling If there in an error during a setfmt, do not overwrite the previous sizes with the invalid config. Without this patch, v4l2-compliance ends up allocating 4GiB of RAM and causin...

DEBIAN-CVE-2021-46943

In the Linux kernel, the following vulnerability has been resolved: media: staging/intel-ipu3: Fix setfmt error handling If there in an error during a setfmt, do not overwrite the previous sizes with the invalid config. Without this patch, v4l2-compliance ends up allocating 4GiB of RAM and causin...

[SECURITY] Fedora 38 Update: libxls-1.6.2-14.fc38

This is libxls, a C library for reading Excel files in the old binary OLE format, plus a command-line tool for converting XLS to CSV named, appropriately enough, libxls2csv...

[SECURITY] Fedora 39 Update: libxls-1.6.2-14.fc39

This is libxls, a C library for reading Excel files in the old binary OLE format, plus a command-line tool for converting XLS to CSV named, appropriately enough, libxls2csv...

libLAS Security Vulnerabilities

libLAS is a libLAS open source library for reading and writing geospatial data encoded in the ASPRS laser file format versions 1.0, 1.1 and 1.2. A security vulnerability exists in libLAS version 1.8.1, which originates from a memory leak contained in /libLAS/apps/ts2las.cpp...

Linux kernel security vulnerabilities

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel, which originates from a memory leak in imufmt...

Fedora: Security Advisory for libxls (FEDORA-2024-8b67e47e43)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-27087

Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As th...

Code injection

Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As th...

CVE-2024-27087

Kirby 4 introduces a link field with a Custom type that can accept javascript: URLs. This leads to cross-site scripting (XSS) when unvalidated Custom links are rendered and clicked by users. The vulnerability stems from insufficient sanitization/validation of Custom links, enabling arbitrary Java...

CVE-2024-27087 Kirby cross-site scripting (XSS) in the link field "Custom" type

Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As th...

llama.cpp GGUF library info->ne heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1914 llama.cpp GGUF library info-ne heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-21802 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library info-ne functionality of llama.cpp Commit 18c2e17. A special...

llama.cpp GGUF library header.n_tensors heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1915 llama.cpp GGUF library header.ntensors heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-21836 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library header.ntensors functionality of llama.cpp Commit...

llama.cpp GGUF library header.n_kv heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1916 llama.cpp GGUF library header.nkv heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-23605 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library header.nkv functionality of llama.cpp Commit 18c2e17. A...

llama.cpp Input Validation Error Vulnerability

llama.cpp is a multimodal model by the individual developer Georgi Gerganov. An input validation error vulnerability exists in versions of llama.cpp prior to 18c2e17, which stems from a heap-based buffer overflow vulnerability in the header.nkv function in GGUF, where a specially crafted .gguf fi...

llama.cpp GGUF library gguf_fread_str heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1913 llama.cpp GGUF library gguffreadstr heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-23496 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library gguffreadstr functionality of llama.cpp Commit 18c2e17....

K000138695: OpenSSL vulnerability CVE-2024-0727

Security Advisory Description Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12...