118 matches found
AlmaLinux 8 : gstreamer1-plugins-base (ALSA-2024:9056)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:9056 advisory. gstreamer: EXIF Metadata Parsing Integer Overflow CVE-2024-4453 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory...
RHEL 8 : gstreamer1-plugins-base (RHSA-2024:9056)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9056 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...
Moderate: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer: EXIF Metadata Parsing Integer Overflow CVE-2024-4453 For more details about the...
gstreamer1-plugins-base security update
1.16.1-4.0.1 - Update origin URL Orabug: 36209826 1.16.1-4 - CVE-2024-4453 gstreamer1: EXIF Metadata Parsing Integer Overflow - Resolves: RHEL-38509...
[SECURITY] Fedora 39 Update: rust-dolby_vision-3.3.0-2.fc39
Dolby Vision metadata parsing and writing...
Fedora: Security Advisory for rust-dolby_vision (FEDORA-2024-ce2936b568)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GHSA-56XG-WFCC-G829 llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
Description llama-cpp-python depends on class Llama in llama.py to load .gguf llama.cpp or Latency Machine Learning Models. The init constructor built in the Llama takes several parameters to configure the loading and running of the model. Other than NUMA, LoRa settings, loading tokenizers, and...
CVE-2023-50186 GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may...
PT-2023-9039 · Gstreamer +6 · Gstreamer +6
Name of the Vulnerable Software and Affected Versions: GStreamer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of GStreamer. The specific flaw exists within the parsing of metadata within AV1 encoded video files...
CVE-2023-33053 Improper Validation of Array Index in Kernel
Memory corruption in Kernel while parsing metadata...
[SECURITY] [DLA 3615-1] libcue security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3615-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 12, 2023 https://wiki.debian.org/LTS -...
CVE-2021-46849
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29421. Reason: This candidate is a duplicate of CVE-2021-29421. Notes: All CVE users should reference CVE-2021-29421 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
U-Boot squashfs filesystem implementation vulnerable to heap-based buffer overflow
Overview U-Boot is a boot loader for multiple platforms, and squashfs filesystem feature is provided since v2020.10-rc2 commit c5100613. squashfs filesystem implementation of U-Boot contains a heap-based buffer overflow vulnerability CWE-122 due to a defect in the metadata reading process...
GHSA-PJCH-4G28-FXX7 External Entity Reference in TwelveMonkeys ImageIO
The package com.twelvemonkeys.imageio:imageio-metadata before version 3.7.1 is vulnerable to XML External Entity XXE Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file e.g. when an online...
DEBIAN-CVE-2021-23792
The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity XXE Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file e.g. when an online profile...
Mozilla Firefox Security Advisory (MFSA2016-10) - Linux
This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
MGASA-2021-0268 Updated python-pikepdf packages fix security vulnerability
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries CVE-2021-29421...
CVE-2021-29421
There's a flaw in the pikepdf Python library's XMP metadata parsing functionality. An attacker who is able to submit a crafted PDF file to be processed by pikepdf could trigger an XML External Entity XXE injection. The highest threat of this flaw is to confidentiality of data...
