241 matches found
CVE-2026-52834
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
EUVD-2026-62513
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834
The Rust crate jxl-grid (versions 0.1.1–0.5.3) computes width * height unchecked in AlignedGrid::with_alloc_tracker, which overflows usize on 32-bit targets, allocating undersized backing buffers. A crafted JPEG XL image decoded via render_frame() triggers out-of-bounds writes through mutable sub...
OPENSUSE-SU-2026:11549-1 markdown-oxide-0.25.12-1.1 on GA media
These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-80597
These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-52834: Heap-based Buffer Overflow
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
Malicious Package
Overview @tailwind-core/oxide-win32-x64-msvc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...
Malicious Package
Overview @tailwind-core/oxide-linux-x64-gnu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
openSUSE 16 Security Update : go-sendxmpp (openSUSE-SU-2026:21277-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21277-1 advisory. Changes in go-sendxmpp: - Update to 0.16.0: Added: Add Ox support to http-upload. Add Ox support for private group chats. Show error cause if...
dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), dset (>=0.1.0, <=0.1.2) +2 more potentially affected by unknown CVE via jxl-oxide (>=0.4.0, <=0.11.4)
jxl-oxide CARGO version =0.4.0, =0.8.2, =0.1.0, =0.1.1, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: OSV:GHSA-66M8-C62J-H6V5...
GHSA-66M8-C62J-H6V5 jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create inval...
PT-2026-57592
Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create inval...
MAL-2026-4448 Malicious code in @tailwind-core/oxide-linux-x64-gnu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a107a0746f2f5159d661e4d332eac53f871b9d22f80caf5863bdd713e252ae00 The package name '@tailwind-core/oxide-linux-x64-gnu' impersonates the legitimate Tailwind CSS v4 oxide engine package...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the sorting parameter. An attacker can execute arbitrary code and insert malicious database content by manipulating crafted URLs. Remediation Upgrade oxid-esales/oxideshop-ce to version 6.3.4 or higher. References -...
