GNU cpio: Multiple vulnerabilities

Background GNU cpio copies files into or out of a cpio or tar archive. Description Two vulnerabilities have been discovered in GNU cpio: The listfile function in GNU cpio contains a heap-based buffer overflow vulnerability CVE-2014-9112 A directory traversal vulnerability has been found in GNU cp...

libpng: User-assisted execution of arbitrary code

Background libpng is a standard library used to process PNG Portable Network Graphics images. It is used by several programs, including web browsers and potentially server processes. Description Two vulnerabilities have been discovered in libpng: The pnguserversioncheck function contains an...

Amazon Linux AMI : jasper (ALAS-2015-479)

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. CVE-2014-8157 An unrestricted stack memory use flaw was found in...

Updated e2fsprogs packages fix CVE-2015-0247

Updated e2fsprogs packages fix security vulnerability: The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to...

Mandriva Linux Security Advisory : glibc (MDVSA-2015:039)

A vulnerability has been discovered and corrected in glibc : Heap-based buffer overflow in the nsshostnamedigitsdots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the 1 gethostbyname or 2 gethostbynam...

Ubuntu 14.04 LTS : GNU binutils vulnerabilities (USN-2496-1)

"The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2496-1 advisory. Michal Zalewski discovered that the setupgroup function in libbfd in GNU binutils did not properly check group headers in ELF files. An attacker could u...

GLSA-201502-01 : mpg123: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201502-01 mpg123: User-assisted execution of arbitrary code An issue has been found in mpg123 when decoding specifically crafted MP3 file, that causes a heap-based buffer overflow. Impact : A remote attacker could entice a user to...

CVE-2014-9673

Integer signedness error in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted Mac font...

CVE-2014-9665

The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact by embedding a PNG file...

Integer overflow

The woffopenfont function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact via ...

Heap overflow

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted OTF font...

Integer overflow

The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact by embedding a PNG file...

CVE-2014-9668

The woffopenfont function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact via ...

CVE-2014-9665

The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact by embedding a PNG file...

CVE-2014-9665

CVE-2014-9665 affects FreeType before 2.5.4, where Load_SBit_Png in sfnt/pngshim.c does not constrain rows/pitch when parsing PNG data embedded in a TTF font. This can trigger an integer overflow and heap-based buffer overflow, leading to denial of service (and possibly other impact) per the CVE ...

CVE-2014-9673

Integer signedness error in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted Mac font...

CVE-2014-9668

CVE-2014-9668 relates to FreeType. The issue stems from the woff_open_font function (sfnt/sfobjs.c) where offset+length is calculated without restricting length values, enabling a remote attacker to trigger a denial of service via a crafted WOFF file (integer overflow and heap-based buffer overfl...

CVE-2014-9673

CVE-2014-9673 details (from provided sources): FreeType before 2.5.4 contains an integer signedness error in the Mac_Read_POST_Resource function (base/ftobjs.c). This vulnerability allows remote attackers to cause a denial of service via a crafted Mac font, potentially triggering a heap-based buf...

CVE-2014-9674

Summary (concrete details only): CVE-2014-9674 affects FreeType prior to 2.5.4, where the Mac_Read_POST_Resource path in base/ftobjs.c validates length values inadequately, enabling an integer overflow and heap-based buffer overflow via a crafted Mac font. This can lead to denial of service and, ...

CVE-2014-9668

The woffopenfont function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact via ...