Out-of-bounds

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist-alphabetsize variable in the readvlcprefix function...

UBUNTU-CVE-2023-46407

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist-alphabetsize variable in the readvlcprefix function...

PT-2023-30005

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit bf814 Description The issue is related to an out of bounds read via the dist-alphabet size variable in the read vlc prefix function. Recommendations For versions prior to commit bf814, consider applying a patch...

CVE-2023-46407: Out-of-bounds Read

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist-alphabetsize variable in the readvlcprefix function...

CVE-2023-46407

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist-alphabetsize variable in the readvlcprefix function...

CVE-2023-46407

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist-alphabetsize variable in the readvlcprefix function...

CVE-2023-46407

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist-alphabetsize variable in the readvlcprefix function...

go-toolset and golang security and bug fix update

An update is available for go-toolset. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming language tools and libraries. Go is...

PT-2023-29849

Name of the Vulnerable Software and Affected Versions Tauri versions prior to 2.0.0-alpha.16 or 1.5.6 Description This issue is related to a misconfiguration in the Tauri documentation that could lead to the leaking of the private key and updater key password into bundled Tauri applications using...

Important: Red Hat Security Advisory: go-toolset and golang security and bug fix update

An update for go-toolset and golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: go-toolset and golang security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fixes: golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-44487 CVE-2023-39325...

Composer allows cache poisoning from other projects built on the same host

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

GHSA-725M-W832-Q973 Composer allows cache poisoning from other projects built on the same host

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

DEBIAN-CVE-2015-8371

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

CVE-2015-8371

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

UBUNTU-CVE-2015-8371

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

CVE-2015-8371: Insufficient Verification of Data Authenticity

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

CVE-2015-8371

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist...

nodejs:18 security, bug fix, and enhancement update

nodejs 1:18.16.1-1 - Rebase to 18.16.1 Resolves: rhbz2188290 rhbz2166926 Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 - Replace /usr/etc/npmrc symlink with builtin configuration Resolves: rhbz2222287 nodejs-nodemon nodejs-packaging 2021.06-4 - NPM bundler: also find...

Malicious code in dist-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ff355bd5f2422ce630aeb0652869d4bdaa8f3f18cf576fc60a76588f3acf36b4 The OpenSSF Package Analysis project identified 'dist-web' @ 99.1.1 npm as malicious. It is considered malicious because: - The package...