OESA-2023-1331 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

EulerOS 2.0 SP5 : vim (EulerOS-SA-2023-2179)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. CVE-2022-3520 - Heap based buffer overflow in vim/vim 9.0.0946 and below...

EulerOS 2.0 SP5 : samba (EulerOS-SA-2023-2168)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrapdes and unwrapdes3 routines of Heimdal. The DES and...

EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2023-2157)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file...

EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2023-2144)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000printpage function in the gdevlp8k.c file. This flaw allows an...

Amazon Linux AMI : pcre (ALAS-2023-1767)

The version of pcre installed on the remote host is prior to 8.21-7.9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1767 advisory. Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to...

Security Bulletin: CVE-2022-48303 may affect IBM CICS TX Advanced 10.1

Summary CVE-2022-48303 may affect IBM CICS TX Advanced 10.1. IBM CICS TX Advanced 10.1 has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-48303 DESCRIPTION: GNU Tar is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the fromheader function in...

Heap-based Buffer Overflow

libopensc.so is vulnerable to Heap-based Buffer Overflow. The vulnerability exists due to the cardoshaveverifyrcpackage function in pkcs15-cardos.c because it scans the ASN1 buffer for 2 tags, but the remaining length can be wrongly calculated due to a moved starting pointer, allowing an attacker...

RenderDoc 1.26 Local Privilege Escalation / Remote Code Execution

Qualys Security Advisory LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863 ======================================================================== Contents ======================================================================== Summary CVE-2023-33865, a symlink...

Ashlar-Vellum Cobalt Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

Amazon Linux 2 : squid (ALAS-2023-2081)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2081 advisory. An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receivi...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-197 advisory. Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version between 4.0.0 to 4.0.5, by default, is susceptible to a heap-based buffer overflow, and...

CVE-2023-24014

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code...

Heap overflow

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code...

Security Bulletin: IBM Planning Analytics Workspace has addressed a vulnerability in GNU zlib (CVE-2022-37434)

Summary IBM Planning Analytics Workspace is vulnerable to a heap-based overlow in GNU zlib . GNU zlib has been upgraded in IBM Planning Analytics Workspace. Vulnerability Details CVEID:CVE-2022-37434 DESCRIPTION: zlib is vulnerable to a heap-based buffer overflow, caused by improper bounds checki...

CVE-2023-24014 Delta Electronics CNCSoft-B DOPSoft Heap-based buffer overflow

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code...

CVE-2023-24014

CVE-2023-24014 maps to a heap-based buffer overflow in Delta Electronics CNCSoft-B DOPSoft (DOPSoft component) affecting versions prior to a fixed release. The vulnerability arises when DOPSoft processes DPA files, enabling an attacker to execute arbitrary code in the context of the current user....

CVE-2023-1388

A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable...

CVE-2023-1388

The CVE describes a heap-based overflow in TA prior to version 5.7.9 that allows a remote attacker to alter the page heap within the macmnsvc process memory block, leading to the Trellix service becoming unavailable. Affected: Trellix Agent components (TA/macOS) using macmnsvc prior to 5.7.9. Imp...

CVE-2023-0666

Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark...