CVE-2025-54349

CVE-2025-54349 affects iperf3 prior to version 3.19.1, caused by an off-by-one in iperf_auth.c leading to a heap-based buffer overflow. Connected advisories confirm a patch was released with iperf3-3.19.1 (and related debian/alma/linux advisories reference the fix). Affected product is iperf3; ro...

CVE-2025-48072 OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR...

CVE-2025-33013

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

NewStart CGSL MAIN 7.02 : gdk-pixbuf2 Vulnerability (NS-SA-2025-0117)

The remote NewStart CGSL host, running version MAIN 7.02, has gdk-pixbuf2 packages installed that are affected by a vulnerability: - In GNOME GdkPixbuf aka gdk-pixbuf through 2.42.10, the ANI Windows animated cursor decoder encounters heap memory corruption in aniloadchunk in io-ani.c when parsin...

CVE-2025-33013

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

CVE-2025-33013

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

CVE-2025-33013

CVE-2025-33013 affects IBM MQ Operator and related container images. The issue is information disclosure caused by improper clearing of heap memory before release, exploitable by a local user. Affected versions include IBM MQ Operator LTS 2.0.0–2.0.29, MQ Operator CD 3.0.0–3.0.1, 3.1.0–3.1.3, 3.3...

CVE-2025-33013 IBM MQ Operator information disclosure

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

CVE-2025-33013 IBM MQ Operator information disclosure

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

PT-2025-30673 · Ibm · Ibm Mq Operator

Name of the Vulnerable Software and Affected Versions: IBM MQ Operator versions 2.0.0 through 2.0.29 IBM MQ Operator versions 3.0.0 through 3.1.3 IBM MQ Operator versions 3.2.0 through 3.2.13 IBM MQ Operator versions 3.3.0 IBM MQ Operator versions 3.4.0 through 3.4.1 IBM MQ Operator versions 3.5....

IBM多款产品 安全漏洞

IBM MQ Operator and others are a tool from International Business Machines IBM used to manage the lifecycle of the IBM MQ Queue Manager. A security vulnerability exists in various IBM products that stems from heap memory not being properly cleared before being freed, which could lead to the...

SUSE CVE-2025-53630

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the ggufinitfromfileimpl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579...

HDF5 Memory Leak Vulnerability

HDF5 is a library of HDF open source . HDF5 memory leakage vulnerability , the vulnerability stems from the file src/H5FL.c function H5FLmalloc did not release or can not release has been dynamically allocated heap memory , an attacker can use this vulnerability leads to denial-of-service attacks...

UBUNTU-CVE-2025-53630

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the ggufinitfromfileimpl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579...

Important: valkey

Issue Overview: Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on the heap, which could lead to remote code execution. CVE-2025-32023 Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on...

Important: redis6

Issue Overview: Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on the heap, which could lead to remote code execution. CVE-2025-32023 Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on...

libxml: Heap use after free (UAF) leads to Denial of service (DoS)

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's...

FreeBSD -- Use-after-free in multi-threaded xz decoder

Problem Description: A worker thread could free its input buffer after decoding, while the main thread might still be writing to it. This leads to an use-after-free condition on heap memory. Impact: An attacker may use specifically crafted .xz file to cause multi-threaded xz decoder to crash, or...

FreeBSD Security Advisory - FreeBSD-SA-25:06.xz

FreeBSD Security Advisory - A worker thread could free its input buffer after decoding, while the main thread might still be writing to it. This leads to an use-after-free condition on heap memory...

CVE-2024-46993

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath and nativeImage.createFromBuffer functions call a function downstream that is vulnerable to a heap...