PT-2022-4542 · Containerd +6 · Kubernetes Containerd +5

Name of the Vulnerable Software and Affected Versions: containerd versions prior to 1.5.13 containerd versions prior to 1.6.6 Description: A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound durin...

IIPImage Remote Memory Corruption Exploit

IIPImage is distributed with a server that enables advanced, high-performance image manipulation for web-based streaming and viewing of high resolution images. The server component called iipsrv.fcgi processes requests from users and passes them to command handlers. Several crashes including an...

[SECURITY] [DLA 3039-1] pypdf2 security update

Debian LTS Advisory DLA-3039-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany June 03, 2022 https://wiki.debian.org/LTS Package : pypdf2 Version : 1.26.0-2+deb9u1 CVE ID : CVE-2022-24859 Debian Bug : 1009879 Sebastian Krause discovered that manipulated inline...

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2023-06866)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a buffer overflow vulnerability that originates from a possible memory corruption when manipulating webp images. An attacker could use the vulnerability to cause...

[SECURITY] [DLA 3037-1] libjpeg-turbo security update

Debian LTS Advisory DLA-3037-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 31, 2022 https://wiki.debian.org/LTS Package : libjpeg-turbo Version : 1:1.5.1-2+deb9u2 CVE ID : CVE-2019-2201 Several integer overflows have been discovered in TurboJPEG, a JPEG...

Moderate: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.6.5 security and bug fix update

The Migration Toolkit for Containers MTC 1.6.5 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Mozilla Firefox 资源管理错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a buffer overflow vulnerability that originates from a possible memory corruption when manipulating webp images. An attacker could use the vulnerability to cause...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.6.58 packages and security update

Red Hat OpenShift Container Platform release 4.6.58 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a...

AZL-9847 CVE-2022-30784 affecting package ntfs-3g for versions less than 2022.5.17-1

A crafted NTFS image can cause heap exhaustion in ntfsgetattributevalue in NTFS-3G through 2021.8.22...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from gzip, jackson-databind, libssh, gnutls, nettle and zlib

Summary Multiple issues were identified in Red Hat UBIubi8/ubi-minimal v8.5-x packages gzip, libssh, gnutls, nettle, zlib and jackson-databind that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images. Vulnerability Details CVEID:CVE-2021-3634 DESCRIPTION: libssh is...

UBUNTU-CVE-2022-30595

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files...

OESA-2022-1670 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

sunshineimages.com Cross Site Scripting vulnerability OBB-2627254

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Server-Side Request Forgery in charm

We've discovered a vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched in https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 and is available in...

GHSA-M8R4-C7JM-W782 Jenkins Plugin Installation Manager Tool did not verify plugin downloads

Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As jenkins-plugin-cli it is used to download and install plugins even before Jenkins is running. Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third...

Jenkins Plugin Installation Manager Tool did not verify plugin downloads

Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As jenkins-plugin-cli it is used to download and install plugins even before Jenkins is running. Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third...

GHSA-FXF3-WX3C-76PF Shopware vulnerable to Cross-site Scripting

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...

Shopware vulnerable to Cross-site Scripting

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...

Information Exposure

Overview mediawiki/core is a Free software wiki application developed by the Wikimedia Foundation and others. Note: This package is not maintained on Packagist anymore, but newer releases exist. Affected versions of this package are vulnerable to Information Exposure via the imgauth.php process. ...

GHSA-HQHF-8JGC-H5HX Magento 2 Community Edition Path Traversal Vulnerability

A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control...