gstreamer:gst-videoparsers: Heap-buffer-overflow in gst_vp9_parser_parse_frame_header

Project: https://anongit.freedesktop.org/git/gstreamer/gstreamer https://gitlab.freedesktop.org/gstreamer/gstreamer.git Detailed Report: https://oss-fuzz.com/testcase?key=4903539546324992 Project: gstreamer Fuzzing Engine: libFuzzer Fuzz Target: gst-videoparsers Job Type: libfuzzerasangstreamer...

DEBIAN-CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

DEBIAN-CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891

The Pillow Python imaging library (versions 9.2.0 through 13.0.0 ) is vulnerable to a quadratic copying issue when saving a GIF file containing a long comment. The root cause is located in the _get_global_header() function, which repeatedly copies portions of comment data from an untrusted input ...

CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401

The Pillow Python imaging library is vulnerable to a Denial of Service (DoS) condition due to inefficient algorithmic complexity (CWE-407) during GIF comment parsing. Specifically, in versions 5.4.0 through 12.9.0 , the GifImageFile._seek() method performs quadratic copying by repeatedly appendin...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

DEBIAN-CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...