Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-5714-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5714-1 advisory. It was discovered that LibTIFF incorrectly handled certain memory operations when using tiffcrop. An attacker could...

MGASA-2022-0410 Updated libtiff packages fix security vulnerability

There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1. CVE-2022-2519 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage at tiffcrop.c:8621 that can cause program crash when reading a crafted input. CVE-2022-2520 It w...

fribidi: SEGV in fribidi_remove_bidi_marks

A segmentation fault SEGV flaw was found in the Fribidi package and affects the fribidiremovebidimarks function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service...

Denial Of Service (DoS)

libjpeg-turbo is vulnerable to denial of service. The vulnerability exists because of a null pointer dereference in jcopysamplerows when processed by libjpeg-turbo which allows an attacker to send a crafted input file causing an application crash...

HTMLMinifier Denial of Service Vulnerability

HTMLMinifier is a Javascript-based HTML compressor/minifier . A denial of service vulnerability exists in HTMLMinifier version 4.0.0, which stems from the program's improper use of regular expressions, and can be exploited by an attacker to cause a denial of service by sending specially crafted...

HTMLMinifier 资源管理错误漏洞

HTMLMinifier is a Javascript-based HTML compressor/minifier . A denial of service vulnerability exists in HTMLMinifier version 4.0.0, which stems from the program's improper use of regular expressions, and can be exploited by an attacker to cause a denial of service by sending specially crafted...

EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2022-2615)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, whe...

Input validation

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4HdlrAtom::AP4HdlrAtom which allows attackers to cause a Denial of Service DoS via a crafted input...

UBUNTU-CVE-2022-43033

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4HdlrAtom::AP4HdlrAtom which allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2022-43033

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4HdlrAtom::AP4HdlrAtom which allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2022-26717 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: An issue in the component AP4 HdlrAtom::AP4 HdlrAtom allows attackers to cause a Denial of Service DoS via a crafted input. This is due to a bad free, which can be exploited to disrupt the service...

CVE-2022-2908

GitLab CVE-2022-2908 affects GitLab CE/EE: DoS via crafted input in the Commit message field causing high CPU. Affected: GitLab versions starting from 10.7 up to 15.1.5, 15.2 up to 15.2.3, and 15.3 up to 15.3.1. Patches exist in 15.1.5, 15.2.3, and 15.3.1 releases; upgrade to these fixed builds w...

CVE-2022-2908

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit messag...

Huawei EulerOS: Security Advisory for gmp (EulerOS-SA-2022-2502)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

OESA-2022-1935 libtiff security update

This libtiff provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libti...

Buffer Overflow

fis-gtm is vulnerable to buffer overflow. The vulnerability exist inutilformat function in utilouput.c where the attacker can control the size of the memset by using a crafted input...

NULL Pointer Dereference

fis-gtm is vulnerable to null pointer difference. The vulnerability exist in FIS GT.M where the attacker uses a crafted input to causa a call to ZREAD to crash...

Denial Of Service (DoS)

fis-gtm is vulnerable to denial of service. The vulnerability exists due to an integer underflow of the size of calls to memset in opfnj3 in srport/opfnj3.c which allows an attacker to cause a segmentation fault and crash the application using crafted input...

OESA-2022-1916 libjpeg-turbo security update

libjpeg-turbo is a JPEG image codec that uses SIMD instructions MMX, SSE2, NEON, AltiVec to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems. Security Fixes: A crafted input file could cause a null pointer dereference in jcopysamplerows when processed by...