CVE-2023-28879

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then...

CVE-2023-28879

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then...

Buffer overflow

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then...

CVE-2023-28879

CVE-2023-28879 affects Ghostscript (through 10.01.0) with a buffer overflow in base/sbcp.c affecting BCPEncode/BCPDecode/TBCPEncode/TBCPDecode. The issue can corrupt internal PostScript interpreter data when the write buffer is near full and an escaped character is written, potentially causing to...

CVE-2023-28879

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then...

CVE-2023-28879

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then...

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data

A malicious Python package on the Python Package Index PyPI repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware. The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and...

openSUSE 15 Security Update : squirrel (openSUSE-SU-2023:0080-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0080-1 advisory. - sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a...

ghostscript -- exploitable buffer overflow in (T)BCP in PS interpreter

[email protected] reports: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less...

The vulnerability of FortiWeb web application command-line interpreter and FortiRecorder video surveillance system devices allows attackers to gain unauthorized access to protected information.

The vulnerability of the command-line interpreter of FortiWeb web applications and FortiRecorder video surveillance devices relates to improper filtering of one or more special elements. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using...

Lexmark Printer Multiple Postscript Interpreter Vulnerabilities (Mar 2023)

Multiple Lexmark printer devices are prone to multiple vulnerabilities in the Postscript interpreter. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Lexmark Printer Multiple Input Validation Vulnerabilities (Mar 2023)

Multiple Lexmark printer devices are prone to multiple input validation vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

A stack overflow issue was discovered in Lua in the luaresume function of 'ldo.c'. This flaw allows a local attacker to pass a specially crafted file to the Lua Interpreter, causing a crash that leads to a denial of service...

lua: use after free allows Sandbox Escape

A flaw was found in the Lua interpreter. This flaw allows an attacker who can have a malicious script executed by the interpreter, to cause a use-after-free issue that may result in a sandbox escape...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-22297

CVE-2022-22297 affects Fortinet FortiWeb and FortiRecorder with an incomplete filtering issue (CWE-792) in the command line interpreter, enabling an authenticated user to read arbitrary files via crafted command arguments. Affected: FortiWeb versions 6.0–6.4.1 and FortiRecorder versions 2.7–6.4.3...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

PT-2023-1737 · Fortinet · Fortiweb +1

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.0 through 6.4.1 FortiRecorder versions 2.7 through 6.4.3 Description: The issue is related to an incomplete filtering of one or more instances of special elements in the command line interpreter. This may allow an...

FortiWeb and FortiRecorder - Arbitrary file read through command line pipe

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiRecorder and FortiWeb may allow an authenticated user to read arbitrary files via specially crafted command arguments...