CVE-2020-10531

An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend function in common/unistr.cpp...

EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

CVE-2020-10233

In version 4.8.0 and earlier of The Sleuth Kit TSK, there is a heap-based buffer over-read in ntfsdinodelookup in fs/ntfs.c...

Heap overflow

In version 4.8.0 and earlier of The Sleuth Kit TSK, there is a heap-based buffer over-read in ntfsdinodelookup in fs/ntfs.c...

Amazon Linux 2 : qemu (ALAS-2020-1401)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1401 advisory. ipreass in ipinput.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the...

SUSE SLED12 Security Update : gimp (SUSE-SU-2020:0601-1)

This update for gimp fixes the following issues : Fix for crashing due to segmentation fault caused by importing ghostscript files. bsc1161998 Security issues fixed: CVE-2017-17785: Fixed an heap-based buffer overflow in FLI import bsc1073625 CVE-2017-17786: Fixed an out-of-bounds read in TGA...

CVE-2020-10233

In version 4.8.0 and earlier of The Sleuth Kit TSK, there is a heap-based buffer over-read in ntfsdinodelookup in fs/ntfs.c...

CVE-2020-10233

CVE-2020-10233 affects The Sleuth Kit (TSK) up to version 4.8.0, where a heap-based buffer over-read occurs in ntfs_dinode_lookup (fs/ntfs.c). Exploitation details are not provided in the available documents, but multiple sources indicate this fixed with a 4.9.0 release. Remediation: upgrade to T...

CVE-2020-10233

In version 4.8.0 and earlier of The Sleuth Kit TSK, there is a heap-based buffer over-read in ntfsdinodelookup in fs/ntfs.c...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2020-0010)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local...

NewStart CGSL MAIN 4.05 : qemu-kvm Multiple Vulnerabilities (NS-SA-2020-0019)

The remote NewStart CGSL host, running version MAIN 4.05, has qemu-kvm packages installed that are affected by multiple vulnerabilities: - mcat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. CVE-2018-11806 - Qemu emulator = 3.0.0 built with the NE2000...

NewStart CGSL CORE 5.04 / MAIN 5.04 : openjpeg2 Vulnerability (NS-SA-2020-0012)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openjpeg2 packages installed that are affected by a vulnerability: - OpenJPEG through 2.3.1 has a heap-based buffer overflow in opjt1clbldecodeprocessor in openjp2/t1.c because of lack of opjj2kupdateimagedimensions...

Updated binutils packages fix security vulnerabilities

This update provides the binutils 2.33.1 and fixes at least the following security issues: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simpleobjectelfmatch in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and...

Heap-based Buffer Overflow

libgd.so is vulnerable to heap-based buffer overflows. The overflows can be triggered when the function gdImageTiffPtr of gdtiff.c reads input images of GD and GD2 formats and does not check the transparent index bounds of the palette. Note: this CVE is disputed because the vendor suggested GD an...

Security Bulletin: Aspera Web Shares application is affected by NGINX Vulnerabilities (CVE-2019-12208, CVE-2019-12207)

Summary IBM Aspera Shares has addressed the following NGINX vulnerabilities. Vulnerability Details CVEID: CVE-2019-12208 DESCRIPTION: NGINX njs is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the njsfunctionnativecall function in njs/njsfunction.c. By sending...

PHP 7.2.x < 7.2.28 / PHP 7.3.x < 7.3.15 / 7.4.x < 7.4.3 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is either 7.2.x prior to 7.2.28, 7.3.x prior to 7.3.15, or 7.4.x prior to 7.4.3. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer overflow condition exists in pharextractfile function due to...

CVE-2017-6363

In the GD Graphics Library aka LibGD through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gdtiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and...

CVE-2017-6363

In the GD Graphics Library aka LibGD through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gdtiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and...

CVE-2017-6363

In the GD Graphics Library aka LibGD through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gdtiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and...

SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2020:0497-1)

This update for python3 fixes the following issues : Update to 3.4.10 jscSLE-9427, bsc1159208 from 3.4.6 : Security issues fixed : Update expat copy from 2.1.1 to 2.2.0 to fix the following issues: CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2017-9233, CVE-2016-9063 CVE-2017-1000158: Fix an...