Security Bulletin: IBM MQ Appliance is vulnerable to heap-based buffer overflow (CVE-2022-48303)

Summary IBM MQ Appliance has resolved a heap-based buffer overflow. Vulnerability Details CVEID:CVE-2022-48303 DESCRIPTION: GNU Tar is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the fromheader function in list.c when processing of V7 archive files. By persuadin...

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-229)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-229 advisory. Potential heap based buffer overflow found in bfdelfslurpversiontables in bfd/elf.c. CVE-2023-1972 Tenable has extracted the preceding description block directly from the tested product security advisor...

Medium: glib2

Issue Overview: Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to cause a denial of service crash or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular...

RHEL 8 : libtiff (RHSA-2023:3827)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3827 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: heap-based buffer...

Moderate: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: heap-based buffer overflow in processCropSelections in tools/tiffcrop.c CVE-2022-48281 For more details about the security issues, including the impact, a CVSS score,...

F5 Networks BIG-IP : Binutils vulnerability (K42059040)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K42059040 advisory. - An issue was discovered in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.32. I...

Oracle Linux 9 : libtiff (ELSA-2023-3711)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3711 advisory. - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799...

RHEL 9 : libtiff (RHSA-2023:3711)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3711 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: heap-base...

Moderate: Red Hat Security Advisory: libtiff security update

An update for libtiff is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : VLC media player vulnerabilities (USN-6180-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6180-1 advisory. It was discovered that VLC could be made to read out of bounds when decoding image files. If a user were tricked into...

Out-of-bounds Write

erofs-utils is vulnerable to Out-of-bounds Write. The vulnerability is in the 'erofsreadonedata' function within 'data.c' which allows a malicious attacker to execute arbitrary code with a crafted erofs filesystem image leading to a heap-based buffer overflow...

Fortinet FortiOS Remote Code Execution Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...

CVE-2023-3291 Heap-based Buffer Overflow in gpac/gpac

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2...

CVE-2023-3291

CVE-2023-3291 concerns the GPAC multimedia framework (gpac/gpac) with a heap-based buffer overflow in versions prior to 2.2.2. Public advisories (Debian DSA-5452-1) state these issues could lead to a denial of service or the execution of arbitrary code. Other sources reiterate the affected compon...

CVE-2023-34474

A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service...

CVE-2023-34474

CVE-2023-34474 is an ImageMagick vulnerability involving a heap-based buffer overflow in ReadTIM2ImageData() (coders/tim2.c). A local attacker can entice a user to open a crafted TIM file, causing an out-of-bounds read that may crash the application and lead to a denial of service. Public referen...

(0Day) Ashlar-Vellum Cobalt Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

(0Day) Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

CVE-2023-27997

A heap-based buffer overflow vulnerability CWE-122 in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all...

CVE-2023-27997

A heap-based buffer overflow vulnerability CWE-122 in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all...