CVE-2023-42326

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfacesgifedit.php and interfacesgreedit.php components...

PT-2023-6864 · Netgate · Pfsense

Name of the Vulnerable Software and Affected Versions: Netgate pfSense version 2.7.0 Description: An issue in Netgate pfSense allows a remote attacker to execute arbitrary code via a crafted request to the interfaces gif edit.php and interfaces gre edit.php components. This is due to the lack of...

SUSE CVE-2023-43281

Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbiloadgifmain function...

CVE-2023-43281

Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbiloadgifmain function...

Double Free

Overview Affected versions of this package are vulnerable to Double Free via the stbiloadgifmain function. An attacker can cause a denial of service by sending a crafted file. Remediation There is no fixed version for stb. References - GitHub Gist - PoC Credit: peccc...

stb Resource Management Error Vulnerability

stb is a single-file public domain library for C/C ++. A security vulnerability exists in stb version v.2.28, which originates from a vulnerability that allows remote attackers to cause a denial of service via a crafted file to the stbiloadgifmain function...

SUSE CVE-2023-45661

stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory...

SUSE CVE-2023-45667

stbimage is a single file MIT licensed library for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls stbiverticalflipslices with th...

Ubuntu 20.04 ESM : Pillow vulnerabilities (USN-5777-2)

The remote Ubuntu 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5777-2 advisory. USN-5777-1 fixed vulnerabilities in Pillow Python 3. This update provides the corresponding updates for Pillow Python 2 in Ubuntu 20.04 LTS. Tenable has...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to the stbigifloadnext function. An attacker can leak internal memory allocation information by triggering an out of bounds memcpy read with a crafted image file. This happens because twoback points to a memory...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the stbiloadgifmainoutofmem function, an attacker can potentially exploit a double-free condition by using a specially crafted image file. This is only exploitable in a multi-threaded environment and, in the worst case, m...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference when the stbiloadgifmain in stbiloadgiffrommemory fails, it returns a null pointer and may leave the z variable uninitialized. If the caller also sets the flip vertically flag, it continues and calls...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the stbiloadgifmain function, an attacker can cause a memory leak or a double-free error by manipulating the delays output value. This is only exploitable if stbiloadgifmain returns a null value and stbiconvertformat is...

DEBIAN-CVE-2023-45664

stbimage is a single file MIT licensed library for processing images. A crafted image file can trigger stbiloadgifmainoutofmem attempt to double-free the out variable. This happens in stbiloadgifmain because when the layers stride value is zero the behavior is implementation defined, but common...

DEBIAN-CVE-2023-45661

stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory...

UBUNTU-CVE-2023-45666

stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a...

UBUNTU-CVE-2023-45664

stbimage is a single file MIT licensed library for processing images. A crafted image file can trigger stbiloadgifmainoutofmem attempt to double-free the out variable. This happens in stbiloadgifmain because when the layers stride value is zero the behavior is implementation defined, but common...

UBUNTU-CVE-2023-45667

stbimage is a single file MIT licensed library for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls stbiverticalflipslices with th...

PT-2023-29635 · Stb Image +3 · Stb Image +3

Name of the Vulnerable Software and Affected Versions: stb image affected versions not specified Description: The issue is related to a crafted image file that may trigger an out of bounds memcpy read in the stbi gif load next function. This occurs because two back points to a memory address lowe...

SUSE CVE-2023-44821

Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect GifRealloc calls, might allow a denial of service memory consumption. NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arriv...