libavc:mvc_dec_fuzzer: Heap-buffer-overflow in ih264d_read_coeff4x4_cabac

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=6236538583711744 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: mvcdecfuzzer Job Type: libfuzzerasanlibavc Platform Id: linux...

Malicious code in acronym-decoder-chrome-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1a3a001eb751394dba7b7d59d8580152ab849a2d8971aecc8c65f800c4276008 The OpenSSF Package Analysis project identified 'acronym-decoder-chrome-angular' @ 1.0.0 npm as malicious. It is considered malicious because: -...

ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Use-of-uninitialized-value in ff_hevc_hls_filter

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5427736120721408 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

The vulnerability of the Decoder.Decode function in the Go programming language allows a hacker to trigger a service failure.

The vulnerability of the Decoder.Decode function in the Go programming language is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

SUSE-SU-2024:3214-1 Security update for go1.23

This update for go1.23 fixes the following issues: - Update go v1.23.1 - CVE-2024-34155: Fixed stack exhaustion in all Parse functions. bsc1230252 - CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. bsc1230253 - CVE-2024-34158: Fixed stack exhaustion in Parse. bsc1230254...

SUSE-SU-2024:3213-1 Security update for go1.22

This update for go1.22 fixes the following issues: - Update go v1.22.7 - CVE-2024-34155: Fixed stack exhaustion in all Parse functions. bsc1230252 - CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode. bsc1230253 - CVE-2024-34158: Fixed stack exhaustion in Parse. bsc1230254...

CVE-2024-40658

In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

BIT-GOLANG-2024-34156 Stack exhaustion in Decoder.Decode in encoding/gob

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that originates from the getConfig method in the SoftVideoDecoderOMXComponent.cpp file contains a heap buffer overflow that could result in an...

NewStart CGSL MAIN 6.02 : libtiff Multiple Vulnerabilities (NS-SA-2024-0051)

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by multiple vulnerabilities: - Buffer overflow in the t2pwritepdfstring function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service crash and possibly...

CVE-2024-34156

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. Mitigation Mitigation for this issue is either not available o...

CVE-2024-34156

Calling Decoder.Decode on a message containing deeply nested structures can trigger a panic due to stack exhaustion . This vulnerability is a follow-up to CVE-2022-30635. Multiple packages in Rocky Linux 8.6 , including cockpit-podman , buildah , container-selinux , conmon , containers-common , c...

GO-2024-3106 Stack exhaustion in Decoder.Decode in encoding/gob

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

OESA-2024-2112 jbig2dec security update

jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2error at /jbig2dec/jbig2.c.CVE-2023-46361...

Google Golang 安全漏洞

Google Golang is a static strongly typed, compiled language from Google.Go's syntax is close to that of C, but differs with respect to variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages that...

K000140964: libarchive vulnerabilities CVE-2018-1000877 and CVE-2018-1000878

Security Advisory Description CVE-2018-1000877 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards release v3.1.0 onwards contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archivereadsupportformatrar.c, parsecodes, reallocrar-lzss.window, newsize wit...

F5 Networks BIG-IP : libarchive vulnerabilities (K000140964)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K000140964 advisory. CVE-2018-1000877libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards release v3.1.0...

CVE-2024-20087

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1550...

PT-2024-32796

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description A problem in the media section of the Linux kernel, specifically with the Mediatek VP8 stateless decoder, has been resolved. The issue led to a kernel crash when fb is NULL. This was due to a...