CVE-2022-41837

CVE-2022-41837 affects the OpenImageIO library (OpenImageIO v2.4.4.2) with an out-of-bounds write in OpenImageIO::add_exif_item_to_spec, causing stack-based memory corruption when processing crafted exif metadata. Exploitation requires a malicious image/file. Public advisories confirm remediation...

CVE-2022-41981

CVE-2022-41981: OpenImageIO v2.3.19.0 contains a stack-based buffer overflow in the TGA file format parser. A crafted TGA can cause out-of-bounds reads/writes on the process stack, enabling arbitrary code execution. Affected component: OpenImageIO’s TGA parser (targa files). Connected sources cor...

CVE-2022-41837

An out-of-bounds write vulnerability exists in the OpenImageIO::addexifitemtospec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

Fedora 36 : vim (2022-40161673a3)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-40161673a3 advisory. The newest upstream commit Security fixes for CVE-2022-3256, CVE-2022-3324, CVE-2022-3352, CVE-2022-3235, CVE-2022-3234, CVE-2022-3296, CVE-2022-329...

OpenImageIO Exif out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2022-1636 OpenImageIO Exif out-of-bounds write vulnerability December 22, 2022 CVE Number CVE-2022-41837 SUMMARY An out-of-bounds write vulnerability exists in the OpenImageIO::addexifitemtospec functionality of OpenImageIO Project OpenImageIO v2.4.4.2...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2022-2835)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-2861)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Use After Free in GitHub repository vim/vim prior to 9.0.0360. CVE-2022-3099 - Use After Free in GitHub repository vim/vim prior to 9.0.0389...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-2835)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Use After Free in GitHub repository vim/vim prior to 9.0.0360. CVE-2022-3099 - Use After Free in GitHub repository vim/vim prior to 9.0.0389...

Fedora 35 : vim (2022-fff548cfab)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-fff548cfab advisory. The newest upstream commit Security fixes for CVE-2022-3256, CVE-2022-3324, CVE-2022-3352, CVE-2022-3235, CVE-2022-3234, CVE-2022-3296, CVE-2022-329...

Fuji Electric Tellus Lite V-Simulator

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: Tellus Lite V-Simulator Vulnerabilities: Out-of-bounds Write, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute...

HCL Notes 缓冲区错误漏洞

HCL Notes is an email software from HCL India. The software supports access to emails, calendars, contacts, etc. HCL Notes suffers from a buffer error vulnerability that stems from vulnerability to a stack-based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView, which can be...

Microsoft Office SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SK...

CVE-2022-44755

CVE-2022-44755 describes a stack-based buffer overflow in lasr.dll within Micro Focus KeyView used by HCL Notes/Lotus Notes. Root cause: overflow in lasr.dll leading to potential remote code execution or crash when handling a crafted Lotus Ami Pro file. Affected software is Lotus Notes/Notes prev...

CVE-2022-44753

CVE-2022-44753 affects HCL Notes (Lotus Notes) and is tied to a stack-based buffer overflow in wp6sr.dll within Micro Focus KeyView. The vulnerability could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. Public documents ...

Microsoft Excel SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP...

Denial Of Service (DoS)

hutool-json and json are vulnerable to Denial Of Service DoS. The vulnerability exists due to a stack-based overflow in the library which allows an attacker to cause an application crash via malicious JSON or XML data...

PT-2022-5855 · Microsoft · 365 Apps For Enterprise

Name of the Vulnerable Software and Affected Versions: Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a stack-based buffer overflow in the Microsoft Office Graphics component. It can be exploited by an attacker using a specially crafted SKP...

Ubuntu 16.04 ESM : Vim vulnerabilities (USN-5775-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5775-1 advisory. It was discovered that Vim uses freed memory in recurisve substitution of specially crafted patterns. An attacker could possbly use this to crash Vim and...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2022-2810)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: jettison-json Jettison used by CICS Transaction Gateway is vulnerable to a denial of service

Summary jettison-json Jettison used by CICS Transaction Gateway is vulnerable to a denial of service, caused by a stack-based buffer overflow CVE-2022-40149 and an out of memory flaw CVE-2022-40150. CICS Transaction Gateway addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-40149...