Debian DLA-1614-1 : openjpeg2 security update

Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec. CVE-2018-6616 Excessive iteration in the opjt1encodecblks function openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. CVE-2018-14423...

skia/android_codec: Use-of-uninitialized-value in sse2::blit_row_s32a_opaque

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5690776718147584 Project: skia Fuzzer: libFuzzerskiaandroidcodec Fuzz target binary: androidcodec Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

USN-3839-1: WavPack vulnerabilities

It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-19840, CVE-2018-19841...

CVE-2018-11261

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, there is a possible Use-after-free issue in Media Codec process. Any application using codec service will be affected...

CVE-2018-11261

Technical details about CVE-2018-11261 are not publicly provided in the supplied connected documents. Monitor for updates; no concrete affected products, versions, or fixes are confirmed in these sources.

Design/Logic Flaw

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, there is a possible Use-after-free issue in Media Codec process. Any application using codec service will be affected...

CVE-2018-11261

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, there is a possible Use-after-free issue in Media Codec process. Any application using codec service will be affected...

CVE-2018-19531

HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting...

CVE-2018-19530

HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely when configured with an xml.codec=httl.spi.codecs.XstreamCodec setting...

JasPer Null Pointer Dereference Vulnerability (CNVD-2019-00809)

JasPer is a Canadian software developer Michael Adams developed a JPEG-2000 codec / decoder open source implementation . A null pointer dereference vulnerability exists in the 'jp2decode' function in the libjasper/jp2/jp2dec.c file in version 2.0.14 of JasPer, which can be exploited by an attacke...

HTTL Remote Command Execution Vulnerability (CNVD-2019-05940)

HTTL also known as Hyper-Text Template Language is an open source Java template engine , it is mainly used for dynamic HTML page output . HTTL 1.0.11 and earlier versions of the 'decodeXml' function has a security vulnerability that stems from the fact that when configured with...

[SECURITY] [DLA 1579-1] openjpeg2 security update

Package : openjpeg2 Version : 2.1.0-2+deb8u5 CVE ID : CVE-2017-17480 CVE-2018-18088 Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec. CVE-2017-17480 Write stack buffer overflow due to missing buffer length formatter in fscanf call jp3d and jpwl codecs...

Libav Denial of Service Vulnerability (CNVD-2019-23073)

Libav formerly FFmpeg is Libav team's set of cross-platform audio and video can be recorded, converted to a solution, which includes a libavcodec encoder. A denial of service vulnerability exists in the 'ffvc1parseframeheaderadv' function of the vc1.c file in Libav version 12.3, which can be...

JasPer Null Pointer Dereference Vulnerability

JasPer is a Canadian software developer Michael Adams developed an open source implementation of the JPEG-2000 codec. A null pointer dereference vulnerability exists in the 'rasputdatastd' function in the ras/rasenc.c file in JasPer version 2.0.14, which can be exploited by an attacker to cause a...

skia/android_codec: Use-of-uninitialized-value in swizzle_index_to_n32

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5767443453050880 Project: skia Fuzzer: libFuzzerskiaandroidcodec Fuzz target binary: androidcodec Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

skia/android_codec: Heap-buffer-overflow in SkGifCodec::haveDecodedRow

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5678720501678080 Project: skia Fuzzer: libFuzzerskiaandroidcodec Fuzz target binary: androidcodec Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Addres...

Vulnerability of the AMediaCodecCryptoInfo_new function in the Android operating system’s framework component, allowing a hacker to execute arbitrary code

The vulnerability of the AMediaCodecCryptoInfonew function in NdkMediaCodec.cpp of the Android operating system’s framework is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a...

CVE-2018-9491

In AMediaCodecCryptoInfonew of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in external apps with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions:...

CVE-2018-9491

In AMediaCodecCryptoInfonew of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in external apps with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions:...

Cisco TelePresence Codec Remote Detection

Detects the installed version of Cisco TelePresence Codec. This script sends an HTTP GET request and tries to ensure the presence of Cisco TelePresence Codec. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...