Medium: oniguruma

Issue Overview: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. CVE-2019-16163 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercasematch in regexec.c.CVE-2019-19246 Affected Packages:...

MGASA-2020-0015 Updated libextractor packages fix security vulnerability

Updated libextractor packages fix security vulnerability: GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTORdviextractmethod in plugins/dviextractor.c CVE-2019-15531...

Updated jhead packages fix security vulnerabilities

Updated jhead package fixes security vulnerabilities: jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and processSOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file CVE-2019-19035. A vulnerability...

CVE-2019-20219

ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c...

EulerOS 2.0 SP8 : binutils (EulerOS-SA-2020-1001)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - loadspecificdebugsection in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based...

CVE-2019-20200

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature...

NewStart CGSL CORE 5.05 / MAIN 5.05 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0227)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities: - The cjpeg utility in libjpeg allows remote attackers to cause a denial of service NULL pointer dereference and application crash or execute...

NewStart CGSL CORE 5.05 / MAIN 5.05 : poppler Multiple Vulnerabilities (NS-SA-2019-0249)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has poppler packages installed that are affected by multiple vulnerabilities: - Poppler before 0.70.0 has a NULL pointer dereference in popplerattachmentnew when called from popplerannotfileattachmentgetattachment. CVE-2018-191...

NewStart CGSL CORE 5.05 / MAIN 5.05 : exempi Multiple Vulnerabilities (NS-SA-2019-0228)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has exempi packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service invalid memcpy with resultant use-after-free...

Heap overflow

GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMFmp4reader.c...

Heap overflow

GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMFNext in GPMFparser.c...

CVE-2019-20086

GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMFNext in GPMFparser.c...

CVE-2019-20087

GoPro GPMF-parser 1.2.3 is affected by a heap-based buffer over-read in GPMF_seekToSamples (GPMF-parse.c) related to the "matching tags" feature. The issue is reported across multiple sources (NVD, Red Hat, OSV, CVE lists) and is tied to CVE-2019-20087. The vulnerability description consistently ...

CVE-2019-20089

Affected software: GoPro GPMF-parser 1.2.3. Issue: a heap-based buffer over-read in GPMF_SeekToSamples within GPMF_parse.c used for size calculation. Root cause per description: reading beyond allocated memory boundaries, enabling an out-of-bounds read. Impact described in the sources as a heap/b...

CVE-2019-15903

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read. Mitigation Mitigation for this issue is either...

CVE-2019-20011

An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decodeR13R2000 in decode.c...

Heap overflow

An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decodeR13R2000 in decode.c...

CVE-2019-20021

CVE-2019-20021 affects UPX, where UPX 3.95 contains a heap-based buffer over-read in canUnpack() within p_mach.cpp when processing crafted Mach-O files. OpenSUSE/Fedora advisories indicate the fix is in UPX 3.96, which patches this vulnerability (and related CVEs) by updating to 3.96. Practical i...

CVE-2019-20011

CVE-2019-20011 is a heap-based buffer over-read in GNU LibreDWG up to version 0.9.3 (decode_R13_R2000 in decode.c). OpenSUSE/SUSE advisories indicate this was addressed by releasing LibreDWG 0.9.3 with overflow checks and related fixes, and other documents corroborate the same vulnerability class...

CVE-2019-20005

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, while parsing a crafted XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running strchr starting with a pointer after a '\0' character where the processing of a string was...