Mozilla: Variable time processing of cross-origin images during drawImage calls

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Denial of Service Vulnerability in ForceControl Technologies ForceControl draw.exe

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. A denial of service vulnerability exists in ForceControl draw.exe, which can be exploited by attackers to cause the application to crash...

harfbuzz:hb-draw-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5668491560747008 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-draw-fuzzer: Heap-buffer-overflow in BEInt<short, 2>::operator short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5750654771658752 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-draw-fuzzer: Use-of-uninitialized-value in OT::TupleVarHeader::calculate_scalar

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5686960406659072 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-draw-fuzzer: Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5088336521986048 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-draw-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x61b000065bf9...

This Apple-FBI Fight Is Different From the Last One

In 2016 the iPhone encryption debate ended in a draw. Don't count on 2020's scuffle over the Pensacola shooter's devices to play out the same way...

OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

[SECURITY] Fedora 31 Update: gd-2.2.5-10.fc31

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

ImageMagick Memory Misreference Vulnerability (CNVD-2019-41001)

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A memory misreference vulnerability exists in TraceBezier in MagickCore/draw.c in versions of ImageMagick prior to 7.0.8-62. An attacker could exploit this vulnerabili...

cad quick draw suffers from dll hijacking vulnerability

Shanghai Xiaomai Technology is an Internet software and engineering data service provider for the building decoration and related manufacturing industries in China. There is a dll hijacking vulnerability in cad quick draw. An attacker can use this vulnerability to load malicious dll and execute...

CVE-2019-2131

An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2...

Sean Barrett stb_vorbis buffer overflow vulnerability (CNVD-2019-41485)

Sean Barrett stbvorbis is an open source audio codec for decoding ogg vorbis files. A buffer error vulnerability exists in the 'drawline' function in Sean Barrett stbvorbis 2019-03-04 and earlier versions. The vulnerability stems from a networked system or product performing operations in memory...

PT-2019-13189 · Nothinq · Stb Vorbis

Name of the Vulnerable Software and Affected Versions: stb vorbis versions through 2019-03-04 Description: The issue is related to an out-of-bounds read of a global buffer in the draw line function. This can be exploited by opening a crafted Ogg Vorbis file, allowing an attacker to cause a denial...

Out-of-bounds

An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. A specially crafted CAL image processed via the application can lead to an out of bounds write overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and...

Out-of-bounds

An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability...

CVE-2018-3976

An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5.0.0.28. A specially crafted CAL image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a CAL image to trigge...

CVE-2018-3973

An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. A specially crafted CAL image processed via the application can lead to an out of bounds write overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and...