PT-2022-17065

Name of the Vulnerable Software and Affected Versions rtl 433 version 21.12 Description A stack overflow was discovered in the function somfy iohc decode. This issue allows attackers to cause a Denial of Service DoS via a crafted file. Recommendations For rtl 433 version 21.12, consider disabling...

pillow:fuzz_pillow: Heap-buffer-overflow in ImagingTgaRleDecode

Detailed Report: https://oss-fuzz.com/testcase?key=5309778291720192 Project: pillow Fuzzing Engine: libFuzzer Fuzz Target: fuzzpillow Job Type: libfuzzerasanpillow Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x616000658a81 Crash State: ImagingTgaRleDecode decode...

CVE-2022-0150

The WP Accessibility Helper WAH WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0150: Improper Neutralization of Input During Web Page Generation

The WP Accessibility Helper WAH WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue...

CLSA-2022-1645466754 Fix of CVE: CVE-2021-43527

CVE-2021-43527: nss: Memory corruption in decodeECorDsaSignature with DSA signatures and RSA-PSS - Pin validation date for PayPalEE test cert...

PT-2022-36842

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow WRITE 4 crash has been reported. The crash state includes functions such as row mt worker hook, execute, and av1 decode tg tiles and...

Debian DSA-5082-1 : php7.4 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5082 advisory. Two security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure or denial of...

PT-2022-6793 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: FFmpeg versions prior to 3.0 Description: An issue was discovered in the FFmpeg package, where the vp3 decode frame function in libavcodec/vp3.c lacks a check of the return value of av malloc, which will cause a null pointer dereference. This...

PT-2022-7206

Name of the Vulnerable Software and Affected Versions STB version 2.27 Description The issue is related to an integer shift of invalid size in the stbi jpeg decode block prog ac component. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial o...

PT-2022-7205 · Libstb +3 · Libstb +3

Name of the Vulnerable Software and Affected Versions: Libstb versions prior to the version with the fixed stb image.h component stb image.h version 2.27 Description: The issue is related to a heap-based use-after-free in the stb image.h component of the Libstb library for C/C++. This can be...

PT-2022-7204 · Unknown +2 · Stb Image.H +2

Name of the Vulnerable Software and Affected Versions: stb image.h version 2.27 Description: The issue is related to an integer overflow in the stbi jpeg decode block prog dc function, which can be exploited by attackers to cause a Denial of Service DoS via unspecified vectors. This can allow a...

wolfmqtt:wolfmqtt-fuzzer: Segv on unknown address in MqttProps_Free

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=6125799097368576 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzermsanwolfmqtt Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash...

open62541:fuzz_json_decode_encode: Heap-buffer-overflow in extensionObjectOrder

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=5663845975195648 Project: open62541 Fuzzing Engine: afl Fuzz Target: fuzzjsondecodeencode Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

GHSA-24X4-6QMH-88QG Use after free in `DecodePng` kernel

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if / ... error conditions ... / png::CommonFreeDecode&decode; OPREQUIREScontext, false, errors::InvalidArgument"PNG size too large for int: ", decode.width, " by ", decode.height; After...

GHSA-9P77-MMRW-69C7 Null-dereference in Tensorflow

Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK: cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kLis...

CVE-2021-44956

Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfifdecode function at ffjpeg/src/jfif.c line 552 could cause a Denial of Service by using a crafted jpeg file...

PT-2022-6565 · Ffjpeg · Ffjpeg

Name of the Vulnerable Software and Affected Versions: ffjpeg versions prior to 01.01.2021 Description: The issue is related to a heap-based buffer overflow in the jfif decode function at ffjpeg/src/jfif.c, which could cause a Denial of Service by using a crafted jpeg file. This can be exploited ...

PT-2022-36818

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a stack-buffer-overflow crash, specifically a WRITE 1 type. The crash occurs in the decompress rNUMBER, read rNUMBER meta data, an...

PYSEC-2022-94

Tensorflow is an Open Source Machine Learning Framework. When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., , the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode. However,...

PYSEC-2022-135

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows...