PT-2022-37250 · Git +1 · C-Blosc2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 4 crash type. The crash state involves functions such as ndlz4 decompress, blosc d, and do job...

grok:grk_decompress_fuzzer: Incorrect-function-pointer-type in grk::BufferedStream::read

Detailed Report: https://oss-fuzz.com/testcase?key=6498826541727744 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerubsangrok Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash State: grk::BufferedStream::read...

Ubuntu: Security Advisory (USN-2419-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-2420-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the decompress.c component in the HDF5 libhdf5 library allows a hacker to execute arbitrary code on the target system.

The vulnerability of the decompress.c component in the HDF5 libhdf5 library is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system by having the user open a specially created malicious GIF...

libjpeg-turbo:decompress_yuv_fuzzer_dev: Crash in jsimd_idct_ifast_sse2.column_end

Detailed Report: https://oss-fuzz.com/testcase?key=5715244021841920 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: decompressyuvfuzzerdev Job Type: libfuzzerasani386libjpeg-turbo Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00001102 Crash State:...

PT-2022-37157

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the fasthuf decode function, internal huf decompress...

CVE-2022-23001 Sweet-B Library: Point compress/decompress using the wrong bit for sign

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public key and the library. The resulting...

DEBIAN-CVE-2022-1922

DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gstmatroskadecompressdata function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS...

PT-2022-5191 · Gstreamer +8 · Gstreamer +8

Name of the Vulnerable Software and Affected Versions: Gstreamer affected versions not specified Description: The issue is caused by an integer overflow in the gst matroska decompress data function of the Gstreamer multimedia framework. This can lead to a potential heap overflow, allowing an...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6400484251926528 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: NULL Sanitizer: memory MSAN Recommended...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::N_AVX2::DecompressDcShiftIrrev::transform

Detailed Report: https://oss-fuzz.com/testcase?key=6587466015965184 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in frame_get_vlmetalayers

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=4580529988567040 Project: c-blosc2 Fuzzing Engine: afl Fuzz Target: decompressframefuzzer Job Type: aflasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

CVE-2022-29225 Zip bomb vulnerability in Envoy

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed...

PT-2022-36995

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include the crash type being a Heap-buffer-overflow READ 2, with the crash sta...

RARLAB UnRAR Directory Traversal Vulnerability

UnRAR is a command that decompresses files with an rar suffix.RARLAB A directory traversal vulnerability exists in versions of UnRAR prior to 6.12. The vulnerability stems from a lack of validity checks on paths when processing directory requests, and can be exploited by attackers to write files...

PT-2022-36963

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported, identified as a Stack-use-after-return READ 1 issue. The crash involves the grk::WaveletReverse::decompress partial tile functio...

GSD-2022-1002173 lz4: fix LZ4_decompress_safe_partial read out of bound

lz4: fix LZ4decompresssafepartial read out of bound This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

PT-2022-30246

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.111 Description The issue is related to a read out of bounds error in the LZ4 decompress safe partial function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-29950

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.34 Description The issue is related to a read out of bounds error in the LZ4 decompress safe partial function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...