ImageMagick: Use after free in ReadMATImage in coders/mat.c

coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service use-after-free and application crash or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c...

ImageMagick: heap-based buffer over-read in WritePNGImage in coders/png.c

An out-of-bounds read was discovered in ImageMagick when writing PNG images. An attacker may abuse this flaw to trick a victim user into downloading a malicious image file and running it through ImageMagick, causing the application to crash...

ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns

A heap-based buffer overflow was discovered in ImageMagick in the way it applies a value with arithmetic, relational, or logical operators to an image due to mishandling columns. Applications compiled against ImageMagick libraries that accept untrustworthy images and use the evaluate-sequence...

ImageMagick: memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c

A flaw was found in ImageMagick version 7.0.8-50 Q16, containing memory leaks of AcquireMagickMemory due to an error found in MagickWand/mogrify.c. It was discovered that ImageMagick does not properly release acquired memory when some error conditions occur in the function MogrifyImageList...

ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment

A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to a misplaced assignment. Applications compiled against ImageMagick libraries that accept untrustworthy images or write PNM images may be vulnerable to this flaw. An attacker could abuse this flaw by...

ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error

A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to a misplaced strncpy and off-by-one errors. Applications compiled against ImageMagick libraries that accept untrustworthy images or write PNM images may be vulnerable to this flaw. An attacker could...

ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows

A heap-based buffer overflow was discovered in ImageMagick in the way it parses images when using the evaluate-sequence option. Applications compiled against ImageMagick libraries that accept untrustworthy images and use the evaluate-sequence option or function EvaluateImages may be vulnerable to...

Fedora: Security Advisory for gd (FEDORA-2020-e795f92d79)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

GitLab EE/CE Access Control Error Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

Security update for cni, cni-plugins, conmon, fuse-overlayfs, podman (moderate)

openSUSE Security Update: Security update for cni, cni-plugins, conmon, fuse-overlayfs, podman Announcement ID: openSUSE-SU-2020:0398-1 Rating: moderate References: 1155217 1160460 1164390 Cross-References: CVE-2019-18466 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerabili...

CVE-2020-10952

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

CVE-2020-10952

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

Code injection

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

CVE-2020-10952

Removed by vendor...

CVE-2020-10952

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

Buildah Path Traversal Vulnerability

Buildah is a tool that supports building OCI container images. A path traversal vulnerability exists in Buildah. The vulnerability stems from a failure of a networked system or product to properly filter for special elements in a resource or file path. An attacker could use this vulnerability to...

PT-2020-12444 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 8.11 through 12.9.1 Description: The issue allows blocked users to pull and push Docker images. This is a significant concern as it bypasses the intended access restrictions for blocked users. Recommendations: For GitLab...

GitLab: XSS on Issue reference numbers

Dear team, I found an XSS that occurs when users move mouse over reference numbers of issues. This XSS occurs on Firefox. It does not occurs on Webkit-based ones such as Safari, Chrome. I haven't tested on Edge. It can be also occured in older browsers due to svg4everybody and...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Arbitrary File Read when Moving an Issue Path Traversal in NPM Package Registry SSRF on Project Import External Users Can Create Personal Snippet Triggers Decription Can be Updated by Other Maintainers in Project Information Disclosure on Confidential Issues Moved to Private...