exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check

An out of bounds read vulnerability was discovered in the way exiv2 parses Canon raw format CRW images. An application that uses exiv2 library to parse untrusted images may be vulnerable to this flaw, which could be used by an attacker to extract data from the application's memory or make it cras...

GHSA-6XHG-Q9C8-RJ32 Credential leak in react-native-fast-image

This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session toke...

TensorFlow Denial of Service Vulnerability (CNVD-2021-36542)

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in TensorFlow. An attacker can exploit this vulnerability by passing empty images to tf.rawops.DrawBoundingBoxes to cause a CHECK failure denial of service...

EulerOS 2.0 SP8 : libtiff (EulerOS-SA-2021-1880)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file...

CVE-2020-18198

Cross Site Request Forgery CSRF in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."...

DEBIAN-CVE-2021-32617

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm quadratic complexity was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata int...

Industrial Light and Magic OpenEXR has a buffer overflow vulnerability (CNVD-2022-19855)

OpenEXR is an image file format from Industrial Light and Magic for high dynamic range HDR images. Industrial Light and Magic OpenEXR is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to execute arbitrary code with the user running an application compiled for...

Exiv2 资源管理错误漏洞

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. A resource management error vulnerability exists in Exiv2 versions prior to 0.27.4 . An attacker could exploit this vulnerability via specially crafted image files to cause a denial of service...

Design/Logic Flaw

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image .tar file which contains symbolic links. The vulnerability is limited to the command oc image extract. If a symbolic link is first...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in TensorFlow. An attacker can exploit this vulnerability by passing empty images to tf.rawops.DrawBoundingBoxes to cause a CHECK failure denial of service...

UBUNTU-CVE-2021-29623

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying...

PT-2021-7922 · Exiv2 +9 · Exiv2 +9

Name of the Vulnerable Software and Affected Versions: Exiv2 versions v0.27.3 and earlier Description: A read of uninitialized memory was found in Exiv2, which is triggered when the utility is used to read the metadata of a crafted image file. This could potentially allow an attacker to leak a fe...

Exiv2 信息泄露漏洞

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. An uninitialized memory read vulnerability exists in Exiv2 0.27.3 and earlier versions. An attacker can exploit the vulnerability to leak a few bytes of stack memory via specially crafted image files...

Adobe After Effects TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe After Effects. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

MGASA-2021-0210 Updated pngcheck packages fix a security vulnerability

This update fixes a divide-by-zero crash bug and probable vulnerability in interlaced images with extra compressed data beyond the nominal end of the image data. found by "chiba of topsec alpha lab" rhbz1949800...

Updated pngcheck packages fix a security vulnerability

This update fixes a divide-by-zero crash bug and probable vulnerability in interlaced images with extra compressed data beyond the nominal end of the image data. found by "chiba of topsec alpha lab" rhbz1949800...

[SECURITY] Fedora 32 Update: djvulibre-3.5.27-25.fc32

DjVu is a web-centric format and software platform for distributing documen ts and images. DjVu can advantageously replace PDF, PS, TIFF, JPEG, and GIF for distributing scanned documents, digital documents, or high-resolution pictu res. DjVu content downloads faster, displays and renders faster,...

DEBIAN-CVE-2021-20309

A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to...

DEBIAN-CVE-2021-20312

A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this...