CVE-2019-20087

GoPro GPMF-parser 1.2.3 is affected by a heap-based buffer over-read in GPMF_seekToSamples (GPMF-parse.c) related to the "matching tags" feature. The issue is reported across multiple sources (NVD, Red Hat, OSV, CVE lists) and is tied to CVE-2019-20087. The vulnerability description consistently ...

CVE-2019-20089

Affected software: GoPro GPMF-parser 1.2.3. Issue: a heap-based buffer over-read in GPMF_SeekToSamples within GPMF_parse.c used for size calculation. Root cause per description: reading beyond allocated memory boundaries, enabling an out-of-bounds read. Impact described in the sources as a heap/b...

CVE-2019-15903

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read. Mitigation Mitigation for this issue is either...

CVE-2019-20011

An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decodeR13R2000 in decode.c...

Heap overflow

An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decodeR13R2000 in decode.c...

CVE-2019-20021

CVE-2019-20021 affects UPX, where UPX 3.95 contains a heap-based buffer over-read in canUnpack() within p_mach.cpp when processing crafted Mach-O files. OpenSUSE/Fedora advisories indicate the fix is in UPX 3.96, which patches this vulnerability (and related CVEs) by updating to 3.96. Practical i...

CVE-2019-20011

CVE-2019-20011 is a heap-based buffer over-read in GNU LibreDWG up to version 0.9.3 (decode_R13_R2000 in decode.c). OpenSUSE/SUSE advisories indicate this was addressed by releasing LibreDWG 0.9.3 with overflow checks and related fixes, and other documents corroborate the same vulnerability class...

CVE-2019-20005

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, while parsing a crafted XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running strchr starting with a pointer after a '\0' character where the processing of a string was...

CVE-2019-19953

In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c...

CVE-2018-10372

processcutuindex in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted binary file, as demonstrated by readelf...

Security Bulletin: Multiple Vulnerabilities in GNU Binutils affects Watson Studio Local

Summary Multiple Vulnerabilities in GNU Binutils affects Watson Studio Local Vulnerability Details CVEID: CVE-2018-18701 DESCRIPTION: An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite...

Security Bulletin: A security vulnerability has been identified in Red Hat® Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM)

Summary RHEL Server is shipped as a component of PPIM. Information about a security vulnerability affecting RHEL Server has been published in a Red Hat errata. Vulnerability Details CVEID: CVE-2018-16839 DESCRIPTION: Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SA...

EulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)

According to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parseencoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service infinite loop via a...

EulerOS 2.0 SP3 : exiv2 (EulerOS-SA-2019-2576)

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service crash due to ...

EulerOS 2.0 SP3 : elfutils (EulerOS-SA-2019-2573)

According to the versions of the elfutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The libelfsetrawdatawrlock function in elfgetdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service crash via a...

EulerOS 2.0 SP3 : taglib (EulerOS-SA-2019-2672)

According to the version of the taglib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based...

EulerOS 2.0 SP3 : netpbm (EulerOS-SA-2019-2635)

According to the versions of the netpbm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to...

EulerOS 2.0 SP3 : tcpdump (EulerOS-SA-2019-2674)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - tcpdump 4.9.0 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via crafted packet data. Th...

EulerOS 2.0 SP3 : memcached (EulerOS-SA-2019-2631)

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume Network Amplification, CWE-406 vulnerability in the UDP...

EulerOS 2.0 SP3 : ncurses (EulerOS-SA-2019-2634)

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ncurses 6.1, there is a NULL pointer dereference at function ncparseentry in parseentry.c that will lead to a denial of service attack. The...