CVE-2024-21802

Talos reports a heap-based buffer overflow in llama.cpp (Commit 18c2e17) related to the GGUF library info->ne parsing when processing .gguf files, which can lead to remote code execution. The vulnerability stems from writing beyond a 4-element info->ne array during gguf_init_from_file, with...

CVE-2024-21802

A heap-based buffer overflow vulnerability exists in the GGUF library info-ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-21802

A heap-based buffer overflow vulnerability exists in the GGUF library info-ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-21836

A heap-based buffer overflow vulnerability exists in the GGUF library header.ntensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-23605

A heap-based buffer overflow vulnerability exists in the GGUF library header.nkv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

llama.cpp GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1912 llama.cpp GGUF library GGUFTYPEARRAY/GGUFTYPESTRING parsing heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-21825 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library GGUFTYPEARRAY/GGUFTYPESTRING...

llama.cpp GGUF library info->ne heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1914 llama.cpp GGUF library info-ne heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-21802 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library info-ne functionality of llama.cpp Commit 18c2e17. A special...

llama.cpp GGUF library header.n_tensors heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1915 llama.cpp GGUF library header.ntensors heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-21836 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library header.ntensors functionality of llama.cpp Commit...

llama.cpp GGUF library header.n_kv heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1916 llama.cpp GGUF library header.nkv heap-based buffer overflow vulnerability February 26, 2024 CVE Number CVE-2024-23605 SUMMARY A heap-based buffer overflow vulnerability exists in the GGUF library header.nkv functionality of llama.cpp Commit 18c2e17. A...

Slackware Linux 15.0 / current openjpeg Vulnerability (SSA:2024-057-01)

The version of openjpeg installed on the remote host is prior to 2.5.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-057-01 advisory. - A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An...

Fedora 38 : mingw-openexr (2024-f4d51715fe)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f4d51715fe advisory. Backport fix for CVE-2023-5841. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 39 : mingw-openexr (2024-7fc5bae919)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-7fc5bae919 advisory. Backport fix for CVE-2023-5841. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2024-23127

A maliciously crafted MODEL, SLDPRT, or SLDASM file, when parsed in ODXSWDLL.dll and libodxdll.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the...

Heap overflow

A maliciously crafted MODEL, SLDPRT or SLDASM file when parsed VCRUNTIME140.dll through Autodesk AutoCAD can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current...

CVE-2024-23127 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

A maliciously crafted MODEL, SLDPRT, or SLDASM file, when parsed in ODXSWDLL.dll and libodxdll.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the...

CVE-2024-23127

Autodesk CVE-2024-23127 affects AutoCAD via parsing MODEL/SLDPRT/SLDASM files, triggering a heap-based overflow in ODXSW_DLL.dll and libodxdll.dll. The vulnerability can allow a crash, data leakage of sensitive information, or arbitrary code execution in the current process. Exploitation context ...

CVE-2024-23127 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

A maliciously crafted MODEL, SLDPRT, or SLDASM file, when parsed in ODXSWDLL.dll and libodxdll.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the...

Debian dsa-5628 : imagemagick - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5628 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5628...

AlmaLinux 8 : oniguruma (ALSA-2024:0889)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0889 advisory. - A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or...

Ubuntu 16.04 LTS : Libspf2 vulnerabilities (USN-6584-2)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6584-2 advisory. USN-6584-1 fixed several vulnerabilities in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This update provides the corresponding updates for CVE-2021-33912 and...