CVE-2019-17530

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4Atom::Inspect in Core/Ap4Atom.cpp...

UBUNTU-CVE-2019-17530

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4Atom::Inspect in Core/Ap4Atom.cpp...

AZL-7266 CVE-2019-17455 affecting package libntlm for versions less than 1.6-1

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request...

UBUNTU-CVE-2019-17455

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request...

DEBIAN-CVE-2019-17401

libyal liblnk 20191006 has a heap-based buffer over-read in the networksharenameoffset20 code block of liblnklocationinformationreaddata in liblnklocationinformation.c, a different issue than CVE-2019-17264. NOTE: the vendor has disputed this as described in the GitHub issue...

UBUNTU-CVE-2019-17401

DISPUTED libyal liblnk 20191006 has a heap-based buffer over-read in the networksharenameoffset20 code block of liblnklocationinformationreaddata in liblnklocationinformation.c, a different issue than CVE-2019-17264. NOTE: the vendor has disputed this as described in the GitHub issue...

openSUSE: Security Advisory for jasper (openSUSE-SU-2019:2279-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : jasper (openSUSE-2019-2282)

This update for jasper fixes the following issues : Security issues fixed : - CVE-2018-19540: Fixed a heap based overflow in jasicctxtdescinput bsc1117508. - CVE-2018-19541: Fix heap based overread in jasimagedepalettize bsc1117507. This update was imported from the SUSE:SLE-15:Update update...

OPENSUSE-SU-2019:2282-1 Security update for jasper

This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19540: Fixed a heap based overflow in jasicctxtdescinput bsc1117508. - CVE-2018-19541: Fix heap based overread in jasimagedepalettize bsc1117507. This update was imported from the SUSE:SLE-15:Update update projec...

OPENSUSE-SU-2019:2279-1 Security update for jasper

This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19540: Fixed a heap based overflow in jasicctxtdescinput bsc1117508. - CVE-2018-19541: Fix heap based overread in jasimagedepalettize bsc1117507. This update was imported from the SUSE:SLE-15:Update update projec...

DEBIAN-CVE-2019-17263

In libyal libfwsi before 20191006, libfwsiextensionblockcopyfrombytestream in libfwsiextensionblock.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed thi...

DEBIAN-CVE-2019-17264

In libyal liblnk before 20191006, liblnklocationinformationreaddata in liblnklocationinformation.c has a heap-based buffer over-read because an incorrect variable name is used for a certain offset. NOTE: the vendor has disputed this as described in the GitHub issue...

DEBIAN-CVE-2019-17266

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soupntlmparsechallenge in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy...

UBUNTU-CVE-2019-17266

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soupntlmparsechallenge in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy...

UBUNTU-CVE-2019-17263

DISPUTED In libyal libfwsi before 20191006, libfwsiextensionblockcopyfrombytestream in libfwsiextensionblock.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has...

UBUNTU-CVE-2019-17264

DISPUTED In libyal liblnk before 20191006, liblnklocationinformationreaddata in liblnklocationinformation.c has a heap-based buffer over-read because an incorrect variable name is used for a certain offset. NOTE: the vendor has disputed this as described in the GitHub issue...

PT-2019-15050 · Libyal +1 · Libfwsi +1

Name of the Vulnerable Software and Affected Versions: libyal libfwsi versions prior to 20191006 Description: The issue is related to a heap-based buffer over-read in the libfwsi extension block copy from byte stream function in libfwsi extension block.c. This occurs because the rejection of an...

PT-2019-15051 · Libyal +1 · Liblnk +1

Name of the Vulnerable Software and Affected Versions: libyal liblnk versions prior to 20191006 Description: The issue is related to a heap-based buffer over-read in the liblnk location information read data function, located in liblnk location information.c, due to the use of an incorrect variab...

PT-2019-4774 · Gnome +2 · Libsoup +2

Name of the Vulnerable Software and Affected Versions: libsoup versions 2.65.1 through 2.68.1 Description: The issue is caused by a heap-based buffer over-read in the soup ntlm parse challenge function, located in soup-auth-ntlm.c, which fails to properly check the length of an NTLM message befor...

CVE-2019-13331

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...