CVE-2018-7644

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing th...

UBUNTU-CVE-2018-7644

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing th...

PT-2018-18229 · Intel · Opencv

Name of the Vulnerable Software and Affected Versions: OpenCV version 3.4.1 Description: The issue is related to the validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp, which allows remote attackers to cause a denial of service due to an assertion failure. This occurs because t...

CVE-2018-7713: Reachable Assertion

The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service assertion failure because size.width = 120 may be false. Note: “OpenCV CVAssert is not an assertion C-like assert, it is regular C++ exception which can...

CVE-2018-7712: Reachable Assertion

The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service assertion failure because size.height = 120 may be false. Note: “OpenCV CVAssert is not an assertion C-like assert, it is regular C++ exception which can...

CVE-2018-7714: Reachable Assertion

The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service assertion failure because pixels = 130 may be false. Note: “OpenCV CVAssert is not an assertion C-like assert, it is regular C++ exception which can raise...

PT-2018-18181

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 1.15.3 Description The issue allows a remote attacker to construct a crafted SAML assertion that would pass as cryptographically valid, enabling them to impersonate a user from an Identity Provider. This is due ...

CVE-2018-5734

While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigger an assertion failure in badcache.c when the request doesn't contain all of the expected...

PT-2018-17117

Name of the Vulnerable Software and Affected Versions: BIND versions 9.10.5-S1 through 9.10.5-S4 BIND versions 9.10.6-S1 through 9.10.6-S2 Description: The issue arises when BIND handles a specific type of malformed packet, incorrectly selecting a SERVFAIL rcode instead of a FORMERR rcode. If the...

PT-2018-6762

Name of the Vulnerable Software and Affected Versions: Exempi versions prior to 2.4.3 Description: An issue in the VPXChunk class in XMPFiles/source/FormatSupport/WEBP Support.cpp allows remote attackers to cause a denial of service via a crafted .webp file, due to the class not ensuring nonzero...

Debian DLA-1285-1 : bind9 security update

BIND, a DNS server implementation, was found to be vulnerable to a denial of service flaw was found in the handling of DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. This issue is closely...

CVE-2018-5735

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar...

PT-2018-17118

Name of the Vulnerable Software and Affected Versions: Debian versions 9.9.5.dfsg-9+deb8u15 through 9.9.5.dfsg-9+deb8u18 Debian version 9.10.3.dfsg.P4-12.3+deb9u5 Debian version 9.11.5.P4+dfsg-5.1 Description: The issue leads to an assertion failure in validator.c at line 1858 due to the Debian...

UBUNTU-CVE-2018-5735

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar...

CVE-2017-17722

A reachable assertion was found in Exiv2 while reading the header of a BigTIFF image. By persuading a victim to open a crafted BigTIFF image, a remote attacker could crash the application...

Authentication flaw

In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file...

PYSEC-2018-121

In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file...

PYSEC-2018-121

In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file...

CVE-2017-17722

CVE-2017-17722 relates to Exiv2 0.26 where a reachable assertion in bigtiffimage.cpp readHeader could enable a remote denial of service via a crafted TIFF file. The connected advisories confirm multiple Exiv2-related issues across formats (CRW, PNG, WebP, PSD) and note the fixed version is 0.27.2...

CVE-2017-17722

In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file...