Heap overflow

io/ZlibCompression.cc in the decompression component in Dropbox Lepton 1.2.1 allows attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact by crafting a jpg image file. The root cause is a missing check of header payloads...

Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2019 CPU)

Binary data oraclewebcenterportalcpuapr2019.nbin...

CVE-2019-11339

The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service out-of-array access or possibly have unspecified other impact via crafted MPEG-4 video data...

OPENSUSE-SU-2019:1206-1 Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.24.0 fixes the following issue: Security issue fixed: - CVE-2019-8375: Fixed an issue in UIProcess subsystem which could allow the script dialog size to exceed the web view size leading to Buffer Overflow or other unspecified impact bsc1126768. This update...

EulerOS Virtualization 2.5.4 : ghostscript (EulerOS-SA-2019-1215)

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The settextdistance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does...

Stack overflow

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a quoted font family value...

CVE-2019-11008

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted image file...

CVE-2019-11005

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a quoted font family value...

CVE-2019-11005

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a quoted font family value...

Poppler <= 0.74.0 Multiple Vulnerabilities

The version of Poppler installed on the remote host is prior or equal to 0.74.0. It is, therefore, affected by the following vulnerabilities : - Multiple input-validation flaws exist that allow heap buffer overflows leading to application crashes and other unspecified impact. CVE-2019-7310,...

openSUSE Security Update : soundtouch (openSUSE-2019-898)

This update for soundtouch fixes the following issues : - CVE-2018-17098: The WavFileBase class allowed remote attackers to cause a denial of service heap corruption from size inconsistency or possibly have unspecified other impact, as demonstrated by SoundStretch. bsc1108632 - CVE-2018-17097: Th...

Design/Logic Flaw

XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted file, related to ntdll!RtlQueueWorkItem...

Design/Logic Flaw

XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted file, related to xnview+0x38536c...

CVE-2019-9964

XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey...

CVE-2019-9877

There is an invalid memory access vulnerability in the function TextPage::findGaps located at TextOutputDev.c in Xpdf 4.01, which can for example be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service Segmentation fault or possibly have...

Directory traversal

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

CVE-2019-6274

CVE-2019-6274 affects GL.iNet GL-AR300M-Lite devices with firmware 2.27, due to a directory traversal vulnerability in storage_cgi. The issue allows remote attackers to influence the system via directory traversal sequences (reported impact as unspecified in the CVE description), with exploit ref...

CVE-2017-12447

GdkPixBuf aka gdk-pixbuf, possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service stack corruption or possibly have unspecified other impact via a crafted file folder...

CVE-2019-9588

There is an Invalid memory access in gAtomicIncrement located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to for example the pdftops binary. It allows an attacker to cause Denial of Service Segmentation fault or possibly have unspecified other impact...

CVE-2019-9589

There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources located in PSOutputDev.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to for example the pdftops binary. It allows an attacker to cause Denial of Service Segmentation fault or possibly have...