CVE-2022-24823

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled. Mitigation As a workaround, speci...

javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6249302768353280 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

PT-2022-16467

Name of the Vulnerable Software and Affected Versions Xpdf versions prior to 4.04 Description The issue is related to the DCT JPEG decoder in Xpdf, which incorrectly allows the interleaved flag to be changed after the first scan of the image. This leads to an unknown integer-related issue in...

GHSA-9VJF-JJCQ-3GH7 Mercurial arbitrary code execution vulnerability

The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a 1 clone, 2 push, or 3 pull command, related to a a list sizing rounding error and b short records...

ffmpeg:ffmpeg_AV_CODEC_ID_FLASHSV2_fuzzer: Heap-use-after-free in inflate

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5718646686613504 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDFLASHSV2fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-use-after-free READ Crash Address:...

javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6143521045741568 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_FLASHSV2_fuzzer: Heap-use-after-free in inflate

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6714732117098496 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDFLASHSV2fuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-use-after-free READ Crash Address: 0x60c0000004...

Fedora: Security Advisory for golang-github-francoispqt-gojay (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-francoispqt-gojay-1.2.13-6.fc36

GoJay is a performant JSON encoder/decoder for Golang currently the most performant, see benchmarks. It has a simple API and doesn't use reflection. It relies on small interfaces to decode/encode structures and slices. Gojay also comes with powerful stream decoding features and an even faster...

[SECURITY] Fedora 36 Update: python-ujson-5.2.0-1.fc36

UltraJSON is an ultra fast JSON encoder and decoder written in pure C with bindings for Python...

CVE-2022-20092

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061...

CVE-2022-20092

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061...

CVE-2022-20092

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061...

Out-of-bounds

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061...

CVE-2022-20092

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061...

CVE-2022-20092

The CVE-2022-20092 issue affects MediaTek devices with the alac decoder. Root cause: missing bounds checks cause an out-of-bounds read, enabling local information disclosure without execution privileges. Exploitation is reported as requiring local access; user interaction is not needed. Patch/mit...

CVE-2022-20092: Out-of-bounds Read

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061...

PT-2022-14336

Name of the Vulnerable Software and Affected Versions alac decoder affected versions not specified Description The issue is related to a missing bounds check in the alac decoder, which could lead to a possible out of bounds read. This might result in local information disclosure without requiring...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jasper (SUSE-SU-2022:1479-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1479-1 advisory. - CVE-2021-3467: Fixed NULL pointer deref in jp2decode bsc1184757. - CVE-2021-3443: Fixed NULL...

Fedora: Security Advisory for golang-github-francoispqt-gojay (FEDORA-2022-5cbd6de569)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...