Input validation

In RestoreMSCWarning of /coders/pdf.c there are several areas where calls to GetPixelIndex could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex to ssizet type to avoid this bug. This undefined behavior could be...

CVE-2020-27771

CVE-2020-27771 affects ImageMagick before 7.0.9-0. In RestoreMSCWarning() of coders/pdf.c, multiple GetPixelIndex() calls could yield values outside the range of unsigned char. The fix casts GetPixelIndex() to ssize_t to prevent undefined behavior when processing crafted PDFs. Red Hat rates this ...

CVE-2020-27771

In RestoreMSCWarning of /coders/pdf.c there are several areas where calls to GetPixelIndex could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex to ssizet type to avoid this bug. This undefined behavior could be...

UBUNTU-CVE-2020-27762

A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but could...

ImageMagick Studio ImageMagick 输入验证错误漏洞

Imagemagick Studio ImageMagick is a suite of open source image processing software from ImageMagick Studio Imagemagick Studio, an American company. The software can read, convert or write images in many formats. A security vulnerability exists in versions prior to ImageMagick 7.0.8-68, which stem...

CVE-2020-27771

In RestoreMSCWarning of /coders/pdf.c there are several areas where calls to GetPixelIndex could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex to ssizet type to avoid this bug. This undefined behavior could be...

CVE-2020-27762

A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but could...

Xpdf 资源管理错误漏洞

Xpdf is a free PDF viewer and toolkit that includes a text extractor, image converter, HTML converter and more. Xpdf 4.02 has a resource management error vulnerability. The vulnerability stems from SplashOutputDev::endType3CharGfxState state SplashOutputDev.cc:3079 attempts to use the freed...

OSV-2020-1676 Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25267 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCrtoRGB::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1859)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A...

OSV-2020-1645 Use-of-uninitialized-value in std::__1::char_traits<char>::length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25076 Crash type: Use-of-uninitialized-value Crash state: std::1::chartraits::length std::1::basicstring, std::1::allocatorch Magick::formatExceptionMessage...

The vulnerability of the cdev_get function in the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the cdevget function in the chardev.c library of the Android operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

DEBIAN-CVE-2020-16166

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c...

Design/Logic Flaw

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c...

OSV-2020-1516 Use-of-uninitialized-value in ScaleQuantumToChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22583 Crash type: Use-of-uninitialized-value Crash state: ScaleQuantumToChar LosslessReduceDepthOK ReadOneMNGImage...

OSV-2020-1138 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14184 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

UBUNTU-CVE-2020-0305

In cdevget of chardev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744...

OSV-2020-846 Heap-buffer-overflow in std::__1::char_traits<char>::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22358 Crash type: Heap-buffer-overflow READ 6 Crash state: std::1::chartraits::compare wabt::stringview::compare wabt::operator==...

OSV-2020-824 UNKNOWN READ in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24057 Crash type: UNKNOWN READ Crash state: std::1::MetaBase, std::1::allocator std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st...

OSV-2020-641 Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14353 Crash type: Use-of-uninitialized-value Crash state: bool std::1::equal, std::1::wr bool std::1::operator== std::1::enableifisconvertiblevdecltype...