SystemDS CPU exhaustion vulnerability

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

Security Bulletin: IBM Security Guardium Insights is affected by Components with known vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-16869 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual whitespaces before the colon in HTTP headers. By sending a...

UBUNTU-CVE-2021-32265

An issue was discovered in Bento4 through v1.6.0-637. A global-buffer-overflow exists in the function AP4MemoryByteStream::WritePartial located in Ap4ByteStream.cpp. It allows an attacker to cause code execution or information disclosure...

heif 代码问题漏洞

HEIF refers to High Efficiency Image File Format, a file format for single images or image sequences. nalutil.cpp in HEIF 3.6.2 and earlier versions of nalutil.cpp contains a null pointer dereference vulnerability in the convertByteStreamToRBSP function. An attacker could exploit this vulnerabili...

Denial of Service in Netty

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder...

CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder...

libyal libfwsi Buffer Overflow Vulnerability

libyal libfwsi is a library for accessing the Windows Shell. The 'libfwsiextensionblockcopyfrombytestream' function in the libfwsiextensionblock.c file in versions prior to libyal libfwsi 20191006 has a Buffer overflow vulnerability, which arises when a networked system or product performs an...

PT-2019-15050 · Libyal +1 · Libfwsi +1

Name of the Vulnerable Software and Affected Versions: libyal libfwsi versions prior to 20191006 Description: The issue is related to a heap-based buffer over-read in the libfwsi extension block copy from byte stream function in libfwsi extension block.c. This occurs because the rejection of an...

Bento4 Null Pointer Dereference Vulnerability (CNVD-2019-40952)

Bento4 is a C++ class library and tool for reading and writing ISO-MP4 files. A null pointer dereference vulnerability exists in AP4ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp in Bento4 1.5.1-628 when called from the AP4TrunAtom class. No detailed vulnerability details are provided at this tim...

UBUNTU-CVE-2019-16349

Bento4 1.5.1-628 has a NULL pointer dereference in AP4ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4TrunAtom class...

UBUNTU-CVE-2018-14587

An issue has been discovered in Bento4 1.5.1-624. AP4MemoryByteStream::WritePartial in Core/Ap4ByteStream.cpp has a buffer over-read...

UBUNTU-CVE-2017-12603

OpenCV Open Source Computer Vision Library through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case...

PT-2017-4339

Name of the Vulnerable Software and Affected Versions: OpenCV versions through 3.3 Description: The issue is related to an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file using cv::imread. This can lead to a buffer overflow,...

Sysax Multi Server 6.40 - SSH Component Denial of Service

''' Exploit title: Sysax Multi Server 6.40 ssh component denial of service vulnerability Date: 29-8-2015 Vendor homepage: http://www.sysax.com Software Link: http://www.sysax.com/download/sysaxservsetup.msi Version: 6.40 Author: 3unnym00n Details: ---------------------------------------------- by...

CVE-2010-1442

VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service invalid memory access and application crash or possibly execute arbitrary code via a crafted byte stream to the 1 AVI, 2 ASF, or 3 Matroska aka MKV demuxer...

CVE-2010-1442

VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service invalid memory access and application crash or possibly execute arbitrary code via a crafted byte stream to the 1 AVI, 2 ASF, or 3 Matroska aka MKV demuxer...

CVE-2010-1441

Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted byte stream to the 1 A/52, 2 DTS, or 3 MPEG Audio decoder...

CVE-2010-1441

Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted byte stream to the 1 A/52, 2 DTS, or 3 MPEG Audio decoder...

CVE-2010-1442

VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service invalid memory access and application crash or possibly execute arbitrary code via a crafted byte stream to the 1 AVI, 2 ASF, or 3 Matroska aka MKV demuxer...

CVE-2010-1442

VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service invalid memory access and application crash or possibly execute arbitrary code via a crafted byte stream to the 1 AVI, 2 ASF, or 3 Matroska aka MKV demuxer...