poppler: integer overflow in JBIG2 decoder using malformed files

An integer overflow issue was discovered in Popplers' JBIG2 decoder in the JBIG2Stream::readTextRegionSeg function in JBIGStream.cc file. This flaw allows an attacker to trick a user into opening a malformed PDF file or JBIG2 image in the application, triggering an integer overflow, which could...

Moderate: Red Hat Security Advisory: poppler security and bug fix update

An update for poppler is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ALSA-2023:2259 Moderate: poppler security and bug fix update

Poppler is a Portable Document Format PDF rendering library, used by applications such as Evince. Security Fixes: poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Moderate: poppler security and bug fix update

Poppler is a Portable Document Format PDF rendering library, used by applications such as Evince. Security Fixes: poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Prototype Pollution

@aedart/support is vulnerable to Prototype Pollution. The vulnerability exists in the resolveMetadataRecord function of meta.ts when merged with a base class metadata object in the meta decoder, which allows an attacker to inject properties into existing prototypes via the MetadataRecord attribut...

[SECURITY] Fedora 36 Update: libheif-1.15.2-1.fc36

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

[SECURITY] Fedora 38 Update: libheif-1.15.2-1.fc38

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Security Bulletin: Multiple vulnerabilities in golang affect IBM Db2® REST

Summary IBM Db2® REST is affected by multiple vulnerabilities found in Golang Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By sending a specially-crafted HTTP/2 stream, a remote attacker could exploi...

ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Index-out-of-bounds in ff_hevc_slice_rpl

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5834725318328320 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

Fedora 36 : libpcap / tcpdump (2023-de10e674ae)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-de10e674ae advisory. New versions of libpcap and tcpdump Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

EulerOS Virtualization 2.9.1 : python3 (EulerOS-SA-2023-1646)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

EulerOS Virtualization 2.9.0 : python3 (EulerOS-SA-2023-1680)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

Juniper Junos OS Vulnerability (JSA70592)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA70592 advisory. - An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder JDPI-Decoder Application Signature component of...

ffmpeg:ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer: Invalid-free in av_freep

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5089709973176320 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDJPEG2000fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Invalid-free Crash Address: 0x7fff988acf...

Fedora 37 : doctl / golang-github-digitalocean-godo (2023-3737bc1c0a)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-3737bc1c0a advisory. Update to 1.93.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

faad2:fuzz_decode: Stack-buffer-overflow in pns_decode

Project: https://github.com/knik0/faad2.git Detailed Report: https://oss-fuzz.com/testcase?key=6656408111415296 Project: faad2 Fuzzing Engine: libFuzzer Fuzz Target: fuzzdecode Job Type: libfuzzerasanfaad2 Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash Address: 0x7ffeaccd4a80...

libavc:svc_dec_fuzzer: Heap-use-after-free in ih264_inter_pred_luma_vert_ssse3

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=6679526687244288 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: svcdecfuzzer Job Type: libfuzzerasanlibavc Platform Id: linux...

OESA-2023-1244 tcpdump security update

Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Security Fixes: The SMB protoco...

OESA-2023-1243 tcpdump security update

Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Security Fixes: The SMB protoco...

Amazon Linux AMI : golang (ALAS-2023-1731)

The version of golang installed on the remote host is prior to 1.18.6-1.43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1731 advisory. Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working...