Scientific Linux Security Update : libtiff on SL7.x x86_64 (20190806)

Security Fixes : - libtiff: buffer overflow in gif2tiff CVE-2016-3186 - libtiff: Heap-based buffer overflow in the cpSeparateBufToContigBuf function resulting in a denial of service or possibly code execution CVE-2018-12900 - libtiff: Out-of-bounds write in tifjbig.c CVE-2018-18557 - libtiff: NUL...

RHEL 7 : qt5 (RHSA-2019:2135)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2135 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt...

libtiff: tiff2bw tool failed memory allocation leads to crash

An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tiflzw.c...

nodejs: Denial of Service with large HTTP headers

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers almost 80 KB per connection, and carefully timed completion of the headers, it is possible to cause the HTTP...

The vulnerability of the pdpl_get_raw handler implementation in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the implementation of the pdplgetraw function parsec/parsec.ko in the Linux kernel relates to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a system failure when there is a memory shortage in the system. This is because the...

Bento4 Denial of Service Vulnerability (CNVD-2019-21439)

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Bento4 version 1.5.1.0, which stems from the program failing to properly handle memory allocation failures. An attacker can exploit this vulnerability to cause a denial of service crash...

Null pointer dereference

An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL...

UBUNTU-CVE-2019-13238

An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL...

CVE-2019-13238

An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL...

CVE-2019-13238

CVE-2019-13238 affects Bento4 1.5.1.0. The issue is an unhandled memory allocation failure in Core/Ap4SdpAtom.cpp that causes a direct copy to a NULL pointer while parsing an atom in the stream, leading to crashes. Related entries describe the vulnerability as an incomplete fix (Incomplete Fix CV...

CVE-2019-13238: NULL Pointer Dereference

An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL...

PT-2019-13200

Name of the Vulnerable Software and Affected Versions Bento4 version 1.5.1.0 Description A memory allocation failure in Core/Ap4SdpAtom.cpp is unhandled, leading to crashes when parsing input video. The program allocates a new buffer to parse an atom in the stream, but the unhandled memory...

SUSE-SU-2019:1733-1 Security update for elfutils

This update for elfutils fixes the following issues: Security issues fixed: - CVE-2018-16403: Fixed a heap-based buffer over-read that could have led to Denial of Service bsc1107067. - CVE-2016-10254: Fixed a memory allocation failure in alloxateelf bsc1030472. - CVE-2019-7665: NTPLATFORM core fi...

USN-4039-1 CImg vulnerabilities

It was discovered that allocation failures could occur in CImg when loading crafted bmp images. An attacker could possibly use this issue to cause a denial of service. CVE-2018-7587 It was discovered that a heap-based buffer over-read existed in CImg when loading crafted bmp images. An attacker...

openSUSE Security Update : elfutils (openSUSE-2019-1590)

This update for elfutils fixes the following issues : Security issues fixed : - CVE-2017-7607: Fixed a heap-based buffer overflow in handlegnuhash bsc1033084 - CVE-2017-7608: Fixed a heap-based buffer overflow in eblobjectnotetypename bsc1033085 - CVE-2017-7609: Fixed a memory allocation failure ...

OPENSUSE-SU-2019:1590-1 Security update for elfutils

This update for elfutils fixes the following issues: Security issues fixed: - CVE-2017-7607: Fixed a heap-based buffer overflow in handlegnuhash bsc1033084 - CVE-2017-7608: Fixed a heap-based buffer overflow in eblobjectnotetypename bsc1033085 - CVE-2017-7609: Fixed a memory allocation failure in...

PT-2019-11019

Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions 2.18.180 through 2.18.294 WhatsApp Business for Android versions 2.18.103 through 2.18.149 Description: The issue arises from a stack allocation failure when receiving calls using WhatsApp on Android, specificall...

SUSE SLED15 / SLES15 Security Update : elfutils (SUSE-SU-2019:1486-1)

This update for elfutils fixes the following issues : Security issues fixed : CVE-2017-7607: Fixed a heap-based buffer overflow in handlegnuhash bsc1033084 CVE-2017-7608: Fixed a heap-based buffer overflow in eblobjectnotetypename bsc1033085 CVE-2017-7609: Fixed a memory allocation failure in...

CVE-2019-12380

DISPUTED An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. physefisetvirtualaddressmap in arch/x86/platform/efi/efi.c and eficallphysprolog in arch/x86/platform/efi/efi64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because...

PT-2019-12772

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.1.6 Description An issue was discovered in the efi subsystem in the Linux kernel. The functions phys efi set virtual address map and efi call phys prolog mishandle memory allocation failures. Recommendations Fo...