DEBIAN-CVE-2023-49464

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::getlumabitsperpixelfromconfigurationunci...

libheif Security Vulnerabilities

libheif is an ISO/IEC 23008-12:2017 HEIF file format decoder and encoder. A security vulnerability exists in libheif version v1.17.5, which stems from the discovery of a containment segmentation violation via the function UncompressedImageCodec::decodeuncompressedimage...

libheif Security Vulnerabilities

libheif is an ISO/IEC 23008-12:2017 HEIF file format decoder and encoder. A security vulnerability exists in libheif version v1.17.5, which stems from the inclusion of a segmentation violation via the UncompressedImageCodec::getlumabitsperpixelfromconfigurationunci discovery function...

CVE-2023-49096 Argument Injection in FFmpeg codec parameters in Jellyfin

Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the /Videos//stream and /Videos//stream. endpoints which are present in the current Jellyfin version. Additional endpoints in the...

PT-2023-31054 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.8.13 Description: The issue concerns an argument injection in the VideosController, specifically the "/Videos//stream" and "/Videos//stream." endpoints, which are reachable by an unauthenticated user. Additional...

Debian: Security Advisory (DLA-3676-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3676-1] libde265 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3676-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky November 30, 2023 https://wiki.debian.org/LTS -...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GStreamer Bad Plugins vulnerabilities (USN-6526-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6526-1 advisory. It was discovered that GStreamer Bad Plugins incorrectly handled certain media files. A remote attacker could use this issue ...

GStreamer Security Vulnerability

GStreamer is a set of frameworks for processing streaming media. A security vulnerability exists in GStreamer versions prior to 1.22.7, which stems from a heap-based buffer overflow vulnerability in the AV1 codec parser when processing certain malformed streams, which can be exploited by an...

GStreamer Security Vulnerability

GStreamer is a set of frameworks for handling streaming media. A security vulnerability exists in GStreamer that stems from a problem with the media framework and its codec and demultiplexer plug-ins, which could result in a denial of service or the execution of arbitrary code if an incorrectly...

PT-2023-30912 · Unknown +1 · Gorilla Codec +2

Name of the Vulnerable Software and Affected Versions: ClickHouse versions 23.3.18.15, 23.8.8.20, 23.9.6.20, 23.10.5.20 ClickHouse Cloud version 23.9.2.47551 Description: A heap buffer overflow issue was discovered in the ClickHouse server, allowing an attacker to send a specially crafted payload...

PT-2023-30765 · Unknown +1 · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse affected versions not specified Description: The issue is an integer underflow resulting in a crash due to a stack buffer overflow in the decompression of the FPC codec. It can be triggered and exploited by an unauthenticated...

CVE-2023-47118

A heap buffer overflow vulnerability affecting the native interface running by default on port 9000/tcp. An attacker, by triggering a bug in the T64 compression codec, can cause the ClickHouse server process to crash. This vulnerability can be exploited without the need to authenticate. Fix has...

Fixed in ClickHouse v23.10.5.20, 2023-11-26​

A heap buffer overflow vulnerability affecting the native interface running by default on port 9000/tcp. An attacker, by triggering a bug in the T64 compression codec, can cause the ClickHouse server process to crash. This vulnerability can be exploited without the need to authenticate...

CVE-2023-48704

A heap buffer overflow vulnerability affecting the native interface running by default on port 9000/tcp. An attacker, by triggering a bug in the Gorilla codec, can cause the ClickHouse server process to crash. This vulnerability can be exploited without the need to authenticate. Fix has been push...

PT-2023-30321 · Unknown +1 · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 23.10.2.13-stable ClickHouse versions prior to 23.9.4.11-stable ClickHouse versions prior to 23.8.6.16-lts ClickHouse versions prior to 23.3.16.7-lts Description: A heap buffer overflow issue was discovered in the...

CVE-2023-48298

An integer underflow vulnerability in the FPC compressions codec. An attacker can use it to cause the ClickHouse server process to crash. This vulnerability can be exploited without the need to authenticate. Fix has been pushed to the following open-source versions: v23.10.4.25, v23.9.5.29,...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9

New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Fedora 39 : gstreamer1-plugin-libav / gstreamer1-plugins-bad-free / etc (2023-6a4aea6d13)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-6a4aea6d13 advisory. 1.22.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Fedora 39 : gst-devtools / gstreamer1 / gstreamer1-doc / python-gstreamer1 (2023-1661e0af22)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-1661e0af22 advisory. Fixes for GStreamer-SA-2023-0010 ZDI-CAN-22299 and GStreamer-SA-2023-0009 ZDI-CAN-22226 CVE-2023-44429 Tenable has extracted the preceding description block...