25 matches found
openSUSE 16 Security Update : python-Pillow (openSUSE-SU-2026:21544-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21544-1 advisory. This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path...
Security update for python-Pillow
This update for python-Pillow fixes the following issues: CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409...
vLLM has RCE In Video Processing
SummaryA chain of vulnerabilities in vLLM allow Remote Code Execution RCE:1. Info Leak - PIL error messages expose memory addresses, bypassing ASLR2. Heap Overflow - JPEG2000 decoder in OpenCV/FFmpeg has a heap overflow that lets us hijack code executionResult: Send a malicious video URL to vLLM...
JLSEC-2026-643
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c...
SUSE SLES15 Security Update : ffmpeg-4 (SUSE-SU-2026:2444-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2444-1 advisory. This update for ffmpeg-4 fixes the following issues Update to version 4.4.7: - CVE-2023-6601: HLS Unsafe File Extension Bypass...
CVE-2026-22778
vLLM is an inference and serving engine for large language models LLMs. From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guess...
GHSA-4R2X-XPJR-7CVV vLLM has RCE In Video Processing
Summary A chain of vulnerabilities in vLLM allow Remote Code Execution RCE: 1. Info Leak - PIL error messages expose memory addresses, bypassing ASLR 2. Heap Overflow - JPEG2000 decoder in OpenCV/FFmpeg has a heap overflow that lets us hijack code execution Result: Send a malicious video URL to...
vLLM has RCE In Video Processing
Summary A chain of vulnerabilities in vLLM allow Remote Code Execution RCE: 1. Info Leak - PIL error messages expose memory addresses, bypassing ASLR 2. Heap Overflow - JPEG2000 decoder in OpenCV/FFmpeg has a heap overflow that lets us hijack code execution Result: Send a malicious video URL to...
PT-2026-5710
Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.3 through 0.14.0 Description vLLM is an inference and serving engine for large language models LLMs. A chain of issues allows for remote code execution RCE when a video model is enabled. First, sending an invalid image to the...
EUVD-2009-0690
Malware in sbrugna...
EUVD-2009-0691
Malware in sbrugna...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-869070)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-869070 advisory. FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Tenable has extracted the...
CVE-2025-9951
FFmpeg is affected by CVE-2025-9951 due to a heap-buffer-overflow in the JPEG 2000 decoder (jpeg2000dec) that can allow remote code execution or denial of service when processing certain JPEG2000 data. Multiple advisories (Debian DLA-4440, Astra Linux, Ubuntu USN-7830-1, and Nessus entries) enume...
OESA-2025-2028 ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg...
CVE-2009-0690
The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream offset in a JPEG2000 aka JPX stream, which allows remote attackers to cause a denial of service memory corruption and application crash or...
SUSE CVE-2025-22921
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c...
DEBIAN-CVE-2025-22921
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c...
UBUNTU-CVE-2025-22921
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c...
