CVE-2021-29533

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK failure by passing an empty image to tf.rawops.DrawBoundingBoxes. This is because the...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in TensorFlow. An attacker can exploit this vulnerability by passing empty images to tf.rawops.DrawBoundingBoxes to cause a CHECK failure denial of service...

OSV-2021-235 Global-buffer-overflow in QSvgSwitch::draw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29873 Crash type: Global-buffer-overflow READ 1 Crash state: QSvgSwitch::draw QSvgTinyDocument::draw QSvgTinyDocument::draw...

Mozilla: Variable time processing of cross-origin images during drawImage calls

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Mozilla: Variable time processing of cross-origin images during drawImage calls

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Mozilla: Variable time processing of cross-origin images during drawImage calls

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Denial of Service Vulnerability in ForceControl Technologies ForceControl draw.exe

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. A denial of service vulnerability exists in ForceControl draw.exe, which can be exploited by attackers to cause the application to crash...

harfbuzz:hb-draw-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5668491560747008 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-draw-fuzzer: Heap-buffer-overflow in BEInt<short, 2>::operator short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5750654771658752 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-draw-fuzzer: Use-of-uninitialized-value in OT::TupleVarHeader::calculate_scalar

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5686960406659072 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-draw-fuzzer: Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5088336521986048 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-draw-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x61b000065bf9...

This Apple-FBI Fight Is Different From the Last One

In 2016 the iPhone encryption debate ended in a draw. Don't count on 2020's scuffle over the Pensacola shooter's devices to play out the same way...

OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

[SECURITY] Fedora 31 Update: gd-2.2.5-10.fc31

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

ImageMagick Memory Misreference Vulnerability (CNVD-2019-41001)

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A memory misreference vulnerability exists in TraceBezier in MagickCore/draw.c in versions of ImageMagick prior to 7.0.8-62. An attacker could exploit this vulnerabili...

cad quick draw suffers from dll hijacking vulnerability

Shanghai Xiaomai Technology is an Internet software and engineering data service provider for the building decoration and related manufacturing industries in China. There is a dll hijacking vulnerability in cad quick draw. An attacker can use this vulnerability to load malicious dll and execute...

CVE-2019-2131

An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2...

Sean Barrett stb_vorbis buffer overflow vulnerability (CNVD-2019-41485)

Sean Barrett stbvorbis is an open source audio codec for decoding ogg vorbis files. A buffer error vulnerability exists in the 'drawline' function in Sean Barrett stbvorbis 2019-03-04 and earlier versions. The vulnerability stems from a networked system or product performing operations in memory...