CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

BIT-TENSORFLOW-2020-15265 Segfault in Tensorflow

In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument and th...

BIT-TENSORFLOW-2021-29560 Heap buffer overflow in `RaggedTensorToTensor`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in tf.rawops.RaggedTensorToTensor. This is because the...

BIT-TENSORFLOW-2021-29579 Heap buffer overflow in `MaxPoolGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGrad is vulnerable to a heap buffer overflow. The...

Deserialization Gadget chain in Swift Mailer dependancy

Summary Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will enable remote code executio...

CVE-2021-46907

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2021-46907

Removed by vendor...

USN-6662-1 openjdk-21 vulnerabilities

Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. CVE-2024-20918 It was discovered that the Hotspot...

SUSE-SU-2024:0619-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 20: bsc1219843 Security fixes: - CVE-2023-33850: Fixed information disclosure vulnerability due to the consumed GSKit library bsc1219843. - CVE-2024-20932: Fixed incorrect handling of ZIP files...

Vyper Input Validation Error Vulnerability

Vyper is the Pythonic smart contract language for EVM. An input validation error vulnerability exists in Vyper 0.3.10 and earlier versions, which stems from a type checker that allows the use of signed integers as the index of an array, potentially resulting in a denial of service...

PT-2024-20454 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to the fixed version Description: The issue arises from the typechecker allowing the usage of signed integers as indexes to arrays, which are defined for unsigned integers only. This can lead to unpredictable behavior,...

Fedora 39 : libcue (2023-f4e74a94a2)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-f4e74a94a2 advisory. This update backports the fix for a serious security issue that could cause arbitrary code execution, tracked as CVE-2023-43641. See this write-up by Kevin...

Rocky Linux 8 : raptor2 (RLSA-2021:1842)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1842 advisory. - raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML...

CVE-2023-46866

In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes...

DemoIccMAX Buffer Error Vulnerability

DemoIccMAX is an open source demo implementation of the iccMAX color profile by the International Color Consortium. DemoIccMAX has a security vulnerability that stems from the ability to access array elements at out-of-bounds indexes...

Ubuntu 23.10 : CUE vulnerability (USN-6423-2)

The remote Ubuntu 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6423-2 advisory. USN-6423-1 fixed a vulnerability in CUE. This update provides the corresponding updates for Ubuntu 23.10. Tenable has extracted the preceding description block direct...

FreeBSD : libcue -- out-of-bounds array access (ae0ee356-6ae1-11ee-bfb6-8c164567ca3c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ae0ee356-6ae1-11ee-bfb6-8c164567ca3c advisory. - libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are...

Debian: Security Advisory (DLA-3615-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3615 : libcue-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3615 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3615-1 [email protected] https://www.debian.org/lts/security/...

Fedora 37 : libcue (2023-1fe05ac8d9)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1fe05ac8d9 advisory. This update backports the fix for a serious security issue that could cause arbitrary code execution, tracked as CVE-2023-43641. See this write-up by Kevin...