CVE-2023-31854

std::badalloc is mishandled in Precomp 0.4.8. NOTE: this is disputed because it should be categorized as a usability problem...

CVE-2023-45919

Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString. NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server...

CVE-2023-46047

An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the saneiconfigureattach function. NOTE: this is disputed because there is no expectation that the product should be starting with an attacker-controlled configuration file...

CVE-2023-31854

CVE-2023-31854 concerns Precomp 0.4.8, where the program mishandles std::bad_alloc. The description notes that this is disputed and should be categorized as a usability problem, which is reflected across multiple sources (NVD/Red Hat/CVE listings). The connected documents confirm the affected com...

CVE-2023-45920

Xfig v3.2.8 contains a NULL pointer dereference in XGetWMHints(), CVE-2023-45920. Multiple connected advisories confirm the issue and note that its remediation has been released: Mageia (MGASA-2024-0125), SUSE (SUSE-SU-2024:1196-1), and OSV entries indicate fixes. Descriptions consistently state ...

CVE-2023-46052

Sane 1.2.1 heap bounds overwrite in initoptions from backend/test.c via a long initmode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file...

CVE-2023-45913

Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId. This vulnerability is triggered when the X11 server sends an DRI2BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is ...

CVE-2023-46052

Sane 1.2.1 heap bounds overwrite in initoptions from backend/test.c via a long initmode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file...

CVE-2023-46049

CVE-2023-46049 describes a NULL pointer dereference in LLVM 15.0.0’s parseOneMetadata() when processing a crafted pdflatex.fmt (or possibly a crafted .o) fed to llvm-lto. The connected Nessus/OpenVAS advisories (TencentOS/Tencent Linux, EulerOS) explicitly cite this description block and note the...

CVE-2023-45931

Mesa 23.0.4 was discovered to contain a NULL pointer dereference in checkxshm for the haserror state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated...

CVE-2023-46052

Sane 1.2.1 heap bounds overwrite in initoptions from backend/test.c via a long initmode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file...

UBUNTU-CVE-2024-24479

DISPUTED A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/tostr.c, and formatfractionalpartnsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected...

CVE-2024-24478

An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissectbgpopentvbuffttvb, prototreetree, packetinfopinfo, optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected...

UBUNTU-CVE-2024-24478

DISPUTED An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissectbgpopentvbuffttvb, prototreetree, packetinfopinfo, optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affecte...

CVE-2024-24479

A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/tostr.c, and formatfractionalpartnsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected...

DEBIAN-CVE-2023-51107

A floating point exception divide-by-zero vulnerability was discovered in Artifex MuPDF 1.23.4 in functon computecolor of jquant2.c. NOTE: this is disputed by the supplier because there was not reasonable evidence to determine the existence of a vulnerability or identify the affected product...

UBUNTU-CVE-2023-44821

DISPUTED Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect GifRealloc calls, might allow a denial of service memory consumption. NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new...

CVE-2023-44821

Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect GifRealloc calls, might allow a denial of service memory consumption. NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arriv...

DEBIAN-CVE-2023-4039

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

AZL-28769 CVE-2023-4039 affecting package gcc for versions less than 11.2.0-6

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...