CVE-2022-30595

CVE-2022-30595 affects Pillow (Python Pillow library) v9.1.0, where libImaging/TgaRleDecode.c can trigger a heap-based buffer overflow when processing invalid TGA files. This is caused by improper handling in TgaRleDecode, with some sources describing potential remote code execution if exploited....

CVE-2022-30595

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files...

CVE-2022-1409

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code...

ALSA-2022:1810 Moderate: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: a buffer overflow via the "invertImage" may lead to DoS CVE-2020-19131 For more details about the security issues, including the impact, a CVSS score, acknowledgments...

Moderate: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: a buffer overflow via the "invertImage" may lead to DoS CVE-2020-19131 For more details about the security issues, including the impact, a CVSS score, acknowledgments...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 General Availability release images. This update provides security fixes, bug fixes, and updates the container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...

Resource exhaustion in Mattermost

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files...

GHSA-F37Q-Q7P2-CCFC Resource exhaustion in Mattermost

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files...

CVE-2022-1337

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files...

CVE-2022-1337 OOM DoS in Mattermost image proxy

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files...

CVE-2022-27821

Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of service via crafted image file...

Samsung quram缓冲区错误漏洞

Samsung SMR is a system patch package from Samsung South Korea. A denial of service vulnerability exists in versions prior to Samsung SMR Apr-2022 Release 1, which stems from incorrect boundary checking in the Quram Agif library and can be exploited by attackers to cause a denial of service via a...

AZL-9187 CVE-2022-1056 affecting package libtiff for versions less than 4.3.0-2

Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd...

Fedora: Security Advisory for libtiff (FEDORA-2022-df1df6debd)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Blender输入验证错误漏洞

Blender is a professional free and open source 3D computer graphics software. A security vulnerability exists in Blender that can be exploited by an attacker to disclose sensitive information or execute code in the context of the Blender process when loading specially crafted image files...

GHSA-XWV6-V7QX-F5JC Code injection in ezsystems/ezpublish-kernel

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, sinc...

CVE-2022-25336

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference IDOR attacks against image files because the image path and filename can be correctly deduced...

CVE-2022-25336

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference IDOR attacks against image files because the image path and filename can be correctly deduced...

CVE-2022-25336

CVE-2022-25336 affects Ibexa DXP Ezpublish-kernel: versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12. The issue is an Insecure Direct Object Reference (IDOR) against image files because the image path and filename can be inferred, enabling access to potentially sensitive images. Connected sour...

Ibexa DXP 安全漏洞

Ibexa Dxp is a single technology stack digital experience platform from Ibexa Norway. It is used to help B2B companies transform their traditional sales strategy into a frictionless buying experience. A security vulnerability in Ibexa DXP ezsystems/ezpublish-kernel, which originated in version...