Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S.A. Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is email client software that supports the IMAP and POP mail protocols as well as the HTML mail format. A...

antlr4-java:GrammarFuzzer: Security exception in org.antlr.v4.parse.ANTLRParser.lexerAlt

Detailed Report: https://oss-fuzz.com/testcase?key=4823002032701440 Project: antlr4-java Fuzzing Engine: libFuzzer Fuzz Target: GrammarFuzzer Job Type: libfuzzerasanantlr4-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.antlr.v4.parse.ANTLRParser.lexerAlt...

checker-framework:UtilCheckerFuzzer: Security exception in org.checkerframework.checker.formatter.util.FormatUtil.formatParameterCategories

Project: https://github.com/typetools/checker-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=4714583912153088 Project: checker-framework Fuzzing Engine: libFuzzer Fuzz Target: UtilCheckerFuzzer Job Type: libfuzzerasanchecker-framework Platform Id: linux Crash Type: Security...

Astra Linux – Vulnerability in libheif

A segmentation fault caused by a floating-point exception exists in libheif 1.15.1 when using crafted heif images through the heif::Fraction::round function in box.cc, which results in a denial of service...

GHSA-M52V-24P8-654F SurrealDB has an Uncaught Exception Sorting Tables by Random Order

Sorting table records using an ORDER BY clause with the rand function as sorting mechanism could cause a panic due to relying on a comparison function that did not implement total order. This event resulted in a panic due to a recent change in Rust 1.81. Impact A client that is authorized to run...

SurrealDB has an Uncaught Exception Sorting Tables by Random Order

Sorting table records using an ORDER BY clause with the rand function as sorting mechanism could cause a panic due to relying on a comparison function that did not implement total order. This event resulted in a panic due to a recent change in Rust 1.81. Impact A client that is authorized to run...

SurrealDB has an Uncaught Exception Handling Nonexistent Role

Roles for system users are stored as generic Ident values and converted as strings and into the Role enum whenever IAM operations are to be performed that require processing the user roles. This conversion expects those identifiers to only contain the values owner, editor and viewer and will retu...

GHSA-JC55-246C-R88F SurrealDB has an Uncaught Exception Handling Nonexistent Role

Roles for system users are stored as generic Ident values and converted as strings and into the Role enum whenever IAM operations are to be performed that require processing the user roles. This conversion expects those identifiers to only contain the values owner, editor and viewer and will retu...

GHSA-H4F5-H82V-5W4R SurrealDB has an Uncaught Exception in Function Generating Random Time

The rand::time function in SurrealQL generates a random time from an optional range of two Unix timestamps. Due to the underlying use of timestampopt from the chrono crate, this function could potentially return None in some instances, leading to a panic when unwrap was called on its result in...

maven-model:Xpp3ReaderFuzzer: Security exception in java.base/java.util.Arrays.copyOfRange

Project: https://github.com/apache/maven.git Detailed Report: https://oss-fuzz.com/testcase?key=4913370627637248 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash...

UBUNTU-CVE-2024-53432

While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::outofrange exception in PCLPointCloud2::at. This issue could potentially be exploited to cause a denial-of-service DoS attack when processing untrusted PLY files...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to an uncaught std::outofrange exception in PCLPointCloud2::at. An attacker can cause the application to crash by submitting specially crafted PLY files. Remediation There is no fixed version for pcl. References -...

CLSA-2024-1732197150 Fix of 20 CVEs

Update to 8u432-ga fixing a number of CVEs - CVE-2024-20918: missing array range check in C1 compiler leads to out-of-bounds access - CVE-2024-20919: unverified bytecode execution because of the flaw in JVM class file verifier - CVE-2024-20921: optimization issue of loop range check in IfNode and...

Authentication Bypass

org.apache.tomcat, tomcat-catalina is vulnerable to Authentication Bypass. The vulnerability exists due to improper exception handling in custom Jakarta Authentication ServerAuthContext components, allowing attackers to bypass authentication and gain unauthorized access...

PCL security vulnerabilities

PCL Point Cloud Library is an open source library for PCL. A security vulnerability exists in PCL version 1.14.1, which stems from an imperfection in its mechanism for handling exceptions, making it susceptible to denial-of-service attacks...

CVE-2024-53432

While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::outofrange exception in PCLPointCloud2::at. This issue could potentially be exploited to cause a denial-of-service DoS attack when processing untrusted PLY files...

CVE-2024-53432

While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::outofrange exception in PCLPointCloud2::at. This issue could potentially be exploited to cause a denial-of-service DoS attack when processing untrusted PLY files...

ARM Mbed OS security vulnerabilities

ARM Mbed OS is a suite of open source embedded operating systems dedicated to the Internet of Things from ARM UK. A security vulnerability exists in ARM Mbed OS version 6.16.0, which originates from a buffer overflow triggered by a function that will continue to write to a temporary header buffer...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...