Piwigo Cross-Site Scripting Vulnerability (CNVD-2021-101688)

Piwigo is a set of Web-based open source image library software. Piwigo has a cross-site scripting vulnerability in version 11.5.0, which stems from a lack of user-supplied data and output data validation filtering. An attacker could exploit this vulnerability to conduct XSS attacks via the syste...

CVE-2021-44017

A vulnerability has been identified in JT2Go All versions V13.2.0.5, Teamcenter Visualization All versions V13.2.0.5. The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to...

Piwigo SQL Injection Vulnerability (CNVD-2021-100297)

Piwigo is a set of Web-based open source image library software. Piwigo v11.5 contains a security vulnerability in /admin/batchmanagerglobal.php in which the parameter pwgtoken is not sufficiently escaped and filtered. No details of the vulnerability are available at this time...

exiv2: DoS due to quadratic complexity in ProcessUTF8Portion

There's a flaw in the xmpsdk component shipped with exiv2. An attacker who is able to submit a crafted file to be processed by an application linked with the exiv2 library could cause an excessive consumption of resources, potentially leading to denial of service. The greatest impact of this flaw...

Leptonica Control Flow DoS

The vulnerability of the Leptonica image processing library is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CLSA-2021-1635459219 Fix CVE(s): CVE-2021-40812, CVE-2021-40145, CVE-2021-38115, CVE-2017-6363

SECURITY UPDATE: unhandled memory allocation error in gdImageGd2Ptr - debian/patches/CVE-2021-40145.patch: check for non-zero return code from gdImageGd2 - CVE-2021-40145 SECURITY UPDATE: unhandled value returned from gdPutBuf - debian/patches/CVE-2021-40812.patch: handle possible gdPutBuf error ...

Pillow Convert.c Buffer Overflow DoS

The vulnerability of the Convert.c component in the Pillow image processing library relates to the ability to pass parameters directly to the function. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failur...

stb:stbi_read_fuzzer: Heap-buffer-overflow in stbi__decode_jpeg_image

Detailed Report: https://oss-fuzz.com/testcase?key=4943518519394304 Project: stb Fuzzing Engine: libFuzzer Fuzz Target: stbireadfuzzer Job Type: libfuzzerasanstb Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x629001140ca8 Crash State: stbidecodejpegimage stbijpegload...

UBUNTU-CVE-2021-28021

Buffer overflow vulnerability in function stbiextendreceive in stbimage.h in stb 2.26 via a crafted JPEG file...

USN-5099-1 imlib2 vulnerability

It was discovered that Imlib2 incorrectly handled certain ICO images. An attacker could use this issue to cause a denial of service and possibly execute arbitrary code...

libjpeg 安全漏洞

libjpeg is a C language library for processing JPEG format image data. It includes JPEG decoding, JPEG encoding and other JPEG functions. A security vulnerability exists in libjpeg that stems from an uncaught floating-point exception in the function ACLosslessScan::ParseMCU located in...

ROS-2-2233

2.2233 Multiple vulnerabilities in libwebp 1. Vulnerability Description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

ROS-2-2224

2.2224 Multiple vulnerabilities in libwebp 1. Vulnerability Description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

PYSEC-2021-883

An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service DOS via a crafted tif file...

exiv2: Heap-based buffer overflow vulnerability in jp2image.cpp

A flaw was found in exiv2. A flawed bounds checking in the jp2Image.cpp:doWriteMetadata function leads to a heap-based buffer overflow. This flaw allows an attacker who can provide a malicious image to an application using the exiv2 library, to write data out of bounds and potentially execute cod...

CVE-2021-28676

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load...

GHSA-RV7P-MMWQ-X674 Improper Input Validation and Code Injection in pdf-image

Lack of input validation in pdf-image npm package version = 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input...

CVE-2021-30473

aomimage.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap...

Pillow 缓冲区错误漏洞

Python Imaging Library PIL is a free library for the Python programming language that supports opening, manipulating, and saving a wide range of image file formats.Pillow is a PIL branch. An out-of-bounds read vulnerability exists in the j2kugrayi function in J2kDecode in versions of Pillow prior...

DEBIAN-CVE-2021-3482

A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data...