RUSTSEC-2023-0087 `MaybeUninit` misuse in `simd-json-derive`

An invalid use of MaybeUninit::uninit.assumeinit in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can...

`MaybeUninit` misuse in `simd-json-derive`

An invalid use of MaybeUninit::uninit.assumeinit in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can...

PT-2023-36100 · Unknown · Simd-Json-Derive

Name of the Vulnerable Software and Affected Versions: simd-json-derive versions prior to 0.12.0 Description: The issue arises from an invalid use of MaybeUninit::uninit.assume init in the derive macro of simd-json-derive, leading to undefined behavior. This misuse can cause invalid memory access...

CVE-2023-44118

Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality...

imagemagick:crop_fuzzer: Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6364110226587648 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: cropfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

PT-2023-29112 · Meetme · Meetme

Name of the Vulnerable Software and Affected Versions: MeeTime module affected versions not specified Description: The issue concerns undefined permissions in the MeeTime module, which can impact availability and confidentiality upon successful exploitation. Recommendations: At the moment, there ...

kernel: fbcon: shift-out-of-bounds in fbcon_set_font()

A flaw was found in the Framebuffer Console fbcon in the Linux Kernel. When providing a font-width and font-height greater than 32 to the fbconsetfont, since there are no checks in place, a shift-out-of-bounds occurs, leading to undefined behavior and possible denial of service...

Medium: ImageMagick

Issue Overview: A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to sizet in svg, mvg and other coders. CVE-2023-34151 Affected Packages: ImageMagick Issue Correction: Run yum update ImageMagick or yum update --advisory ALAS-2023-1844 to update...

PT-2023-19822 · Unknown · Data Modem

Name of the Vulnerable Software and Affected Versions: Data Modem affected versions not specified Description: The issue is related to Information Disclosure in the Data Modem when performing a VoLTE call with an undefined RTCP FB line value. Recommendations: At the moment, there is no informatio...

CVE-2023-41996: Undefined Security Weakness

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6. Apps that fail verification checks may still launch...

ffmpeg:ffmpeg_AV_CODEC_ID_FLIC_fuzzer: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5558602804625408 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDFLICfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace...

Important: ecs-service-connect-agent

Issue Overview: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issu...

Important: ecs-service-connect-agent

Issue Overview: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issu...

CVE-2023-40018

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candida...

Undefined Behavior for Input to API in Mutt

...

Undefined Behavior for Input to API in Mutt

...

PT-2023-11129 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue, potentially affected devices, or real-world incidents. Recommendations: At th...

PT-2023-11054 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The provided information does not contain details about the issue, affected devices, or real-world incidents. Recommendations: At the moment, there is no information about a newer versi...

CVE-2023-39915: Improper Handling of Undefined Values

NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914...

Users vulnerable to unaligned read of `*const *const c_char` pointer

Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior. In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in some other way, including the possibilit...