freerdp: out of bounds read in zgfx decoder

An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service...

poppler: integer overflow in JBIG2 decoder using malformed files

An integer overflow issue was discovered in Popplers' JBIG2 decoder in the JBIG2Stream::readTextRegionSeg function in JBIGStream.cc file. This flaw allows an attacker to trick a user into opening a malformed PDF file or JBIG2 image in the application, triggering an integer overflow, which could...

Moderate: Red Hat Security Advisory: poppler security and bug fix update

An update for poppler is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ALSA-2023:2259 Moderate: poppler security and bug fix update

Poppler is a Portable Document Format PDF rendering library, used by applications such as Evince. Security Fixes: poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Moderate: poppler security and bug fix update

Poppler is a Portable Document Format PDF rendering library, used by applications such as Evince. Security Fixes: poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Prototype Pollution

@aedart/support is vulnerable to Prototype Pollution. The vulnerability exists in the resolveMetadataRecord function of meta.ts when merged with a base class metadata object in the meta decoder, which allows an attacker to inject properties into existing prototypes via the MetadataRecord attribut...

[SECURITY] Fedora 36 Update: libheif-1.15.2-1.fc36

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

[SECURITY] Fedora 38 Update: libheif-1.15.2-1.fc38

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Security Bulletin: Multiple vulnerabilities in golang affect IBM Db2® REST

Summary IBM Db2® REST is affected by multiple vulnerabilities found in Golang Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By sending a specially-crafted HTTP/2 stream, a remote attacker could exploi...

Fedora 36 : libpcap / tcpdump (2023-de10e674ae)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-de10e674ae advisory. New versions of libpcap and tcpdump Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

EulerOS Virtualization 2.9.0 : python3 (EulerOS-SA-2023-1680)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

EulerOS Virtualization 2.9.1 : python3 (EulerOS-SA-2023-1646)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

Juniper Junos OS Vulnerability (JSA70592)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA70592 advisory. - An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder JDPI-Decoder Application Signature component of...

Fedora 37 : doctl / golang-github-digitalocean-godo (2023-3737bc1c0a)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-3737bc1c0a advisory. Update to 1.93.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

OESA-2023-1243 tcpdump security update

Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Security Fixes: The SMB protoco...

OESA-2023-1244 tcpdump security update

Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Security Fixes: The SMB protoco...

Amazon Linux AMI : golang (ALAS-2023-1731)

The version of golang installed on the remote host is prior to 1.18.6-1.43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1731 advisory. Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working...

The vulnerability of the decoder_context::processSliceSegmentHeader function (decctx.cc) in the implementation of the h.265 Libde265 video codec allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the decodercontext::processSliceSegmentHeader function decctx.cc in the H.265 Libde265 video codec implementation is related to pointer swapping errors. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the...

Important: jasper

Issue Overview: A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causing an arbitrary out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2020-27828 ...

CBL Mariner 2.0 Security Update: application-gateway-kubernetes-ingress / golang / kubevirt / skopeo / telegraf (CVE-2022-41723)

The version of application-gateway-kubernetes-ingress / golang / kubevirt / skopeo / telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41723 advisory. - A maliciously crafted HTTP/2 stream...