Code injection

When malicious images are pulled by isula pull, attackers can execute arbitrary code...

CVE-2021-33636 Load malicious images may cause process to be hijacked

When the isula load command is used to load malicious images, attackers can execute arbitrary code...

CVE-2021-33636

CVE-2021-33636 is discussed in connected documents as affecting iSulad used in EulerOS and related advisories. The vulnerability occurs when the isula load command is used to load malicious images, allowing attackers to execute arbitrary code on the host. According to the CVSS in the initial docu...

CVE-2021-33636 Load malicious images may cause process to be hijacked

When the isula load command is used to load malicious images, attackers can execute arbitrary code...

CVE-2021-33635 Pull malicious images may cause process to be hijacked

When malicious images are pulled by isula pull, attackers can execute arbitrary code...

CVE-2021-33635 Pull malicious images may cause process to be hijacked

When malicious images are pulled by isula pull, attackers can execute arbitrary code...

CVE-2021-33634

CVE-2021-33634 affects Huawei EulerOS packages using iSulad with the default lcr+lxc runtime. The advisory documents describe that running malicious images can lead to a denial-of-service (DoS) condition. CVSS data indicates medium severity (base 5.5–6.3 depending on source), with local access re...

CVE-2021-33634 Malicious image running containers may cause DoS attacks

iSulad uses the lcr+lxc runtime default to run malicious images, which can cause DOS...

PT-2023-12215 · Isula · Isula

Name of the Vulnerable Software and Affected Versions: isula affected versions not specified Description: The issue allows attackers to execute arbitrary code when malicious images are pulled by isula pull. Recommendations: At the moment, there is no information about a newer version that contain...

PT-2023-12214 · Isulad · Isulad

Name of the Vulnerable Software and Affected Versions: iSulad affected versions not specified Description: The issue is related to iSulad using the lcr+lxc runtime by default to run malicious images, which can cause a Denial of Service DOS. Recommendations: At the moment, there is no information...

PT-2023-12216 · Isula · Isula

Name of the Vulnerable Software and Affected Versions: isula affected versions not specified Description: When the isula load command is used to load malicious images, attackers can execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains...

Denial Of Service (DoS)

imagemagick is vulnerable to Denial of Service DoS. A heap-based buffer overflow vulnerability allows an attacker to cause denial of service conditions via ReadTIFFImage in coders/tiff.c, by exploiting a flaw in the way that ImageMagick handles TIFF images...

CVE-2023-40134

In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40135

In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40137

In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40136

In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40139

In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Information disclosure

In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Information disclosure

In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Information disclosure

In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...