Remote Code Execution (RCE)

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Remote Code Execution RCE due to using torch.utils.data.datapipes.utils.decoder.basichandlers function. An attacker can execute arbitrary code ...

Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers

Summary Using torch.utils.data.datapipes.utils.decoder.basichandlers function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

ROS-20250822-11

A vulnerability in the HPACK decoder of Golang programming is related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting locally to cause a denial of service...

CVE-2025-55398: Improper Validation of Specified Quantity in Input

An issue was discovered in mouse07410 asn1c thru 0.9.29 2025-03-20 - a fork of vlm asn1c. In UPER Unaligned Packed Encoding Rules, asn1c-generated decoders fail to enforce INTEGER constraints when the bound is positive and exceeds 32 bits in length, potentially allowing incorrect or malicious inp...

ffmpeg:ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer: Heap-use-after-free in decode_usac_core_coder

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5217809212964864 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDAACLATMfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type:...

Linux Distros Unpatched Vulnerability : CVE-2022-24823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an open-source, asynchronous event-driven network application framework. The package io.netty:netty-codec-http prior to version 4.1.77.Final contains a...

Linux Distros Unpatched Vulnerability : CVE-2021-37137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable...

Linux Distros Unpatched Vulnerability : CVE-2021-37136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size used during...

Linux Distros Unpatched Vulnerability : CVE-2022-39244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and...

ffmpeg:ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer: Use-of-uninitialized-value in add_median_pred_c

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5635866203848704 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDUTVIDEODECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer: Heap-buffer-overflow in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5093159807025152 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDPRORESRAWDECfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Index-out-of-bounds in hevc_decode_init

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4956250308935680 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type:...

Linux Distros Unpatched Vulnerability : CVE-2022-24106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Xpdf prior to 4.04, the DCT JPEG decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unkno...

Linux Distros Unpatched Vulnerability : CVE-2025-2310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MMstrndup of the component Metadata Attribute Decoder. Th...

ffmpeg:ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer: Global-buffer-overflow in decode_comp

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6649466540326912 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDPRORESRAWDECfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer: Heap-buffer-overflow in dxv_decompress_dxt5

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5850827739955200 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDDXVDECfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type:...

CVE-2025-38543

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dmaalloccoherent error check Check for NULL return value with dmaalloccoherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'...

OESA-2025-2029 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg...

OESA-2025-2028 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg...

ffmpeg:ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer: Use-of-uninitialized-value in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5464037027807232 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDUTVIDEODECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...