CVE-2025-48074 OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance...

OpenEXR 安全漏洞

OpenEXR is an open standard for high dynamic range image HDR file formats. A security vulnerability exists in OpenEXR version 3.3.2, which can be exploited by attackers to cause excessive memory allocation and performance degradation when processing malicious files...

ROS-20250801-01

A vulnerability in a set of add-on tools and libraries for the Go language designed to integrate with the OpenTelemetry, OpenTelemetry-Go Contrib is related to unconstrained and unregulated resource allocation when adding net.peer.sock.addr and net.peer.sock.port tags. regulation when adding...

SUSE CVE-2025-38426

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add basic validation for RAS header If RAS header read from EEPROM is corrupted, it could result in trying to allocate huge memory for reading the records. Add some validation to header fields...

GHSA-X22W-82JP-8RVF OpenEXR Out-Of-Memory via Unbounded File Header Values

Summary The OpenEXR file format defines many information about the final image inside of the file header, such as the size of data/display window. The application trusts the value of dataWindow size provided in the header of the input file, and performs computations based on this value. This may...

K000152843: Erlang/OTP vulnerabilities CVE-2025-26618, CVE-2025-30211, and CVE-2025-46712

Security Advisory Description CVE-2025-26618 Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use...

PT-2025-31589

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.3.3 Description OpenEXR is an image storage format used in the motion picture industry. Versions prior to 3.3.3 trust unvalidated dataWindow size values from file headers, potentially leading to excessive memory...

The vulnerability in the kernel modules driver/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the kernel modules such as drivers/gpu/drm/amd/amdgpu/amdgpuraseeprom.c of the Linux operating system is related to unlimited resource allocation. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the mas_preallocate() function in the lib/maple_tree.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the maspreallocate function in the lib/mapletree.c module of the Linux kernel is related to the pointer dereferencing that occurs due to incorrect memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: ipv6: mcast: extend RCU protection in igmp6_send()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6send igmp6send can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use...

kernel: media: uvcvideo: Fix double free in error path

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvcstatusinit function fails to allocate the inturb, it will free the dev-status pointer but doesn't reset the pointer to NULL. This results in the kfree call in...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to uncontrolled memory distribution, allows a attacker to cause service interruptions.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specially crafted requests...

SUSE CVE-2025-38445

In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1reshape In the raid1reshape function, newpool is allocated on the stack and assigned to conf-r1biopool. This results in conf-r1biopool.wait.head pointing to a stack address...

kernel: ipv6: mcast: extend RCU protection in igmp6_send()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6send igmp6send can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use...

grafana security update

An update is available for grafana. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

RLSA-2025:3411 Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 For more details about the security issues, including the impact, a CVSS score,...

RLSA-2025:3344 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 For more details about the security issues, including the impact, a CVSS...

zlib: Out-of-bound pointer arithmetic in inftrees.c

A vulnerability was discovered in the inftrees.c file of zlib. Pointer arithmetic operations violate the C standard by subtracting an offset from an array pointer before its allocated memory, leading to undefined behavior...

SUSE CVE-2024-38536

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation failure due to http.memcap being reached leads to a NULL-ptr reference leading to a crash. Upgrade to 7.0.6...

SUSE CVE-2025-29916

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the hashsize to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can...