OSV-2023-936 Heap-buffer-overflow in Gfx::decode_bmp_pixel_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62782 Crash type: Heap-buffer-overflow READ 1 Crash state: Gfx::decodebmppixeldata Gfx::BMPImageDecoderPlugin::frame Gfx::ICOImageDecoderPlugin::loadicobitmap...

curl: CVE-2023-38545: socks5 heap buffer overflow

Vulnerability description not provided...

PT-2023-36042 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the pack unpack function, mrb pack unpack function, and mrb vm exec function...

Slackware Linux 15.0 / current libvpx Vulnerability (SSA:2023-273-01)

The version of libvpx installed on the remote host is prior to 1.12.0 / 1.13.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-273-01 advisory. - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote...

Debian DSA-5508-1 : chromium - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5508 advisory. - Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to...

PT-2023-36041 · Git +1 · Serenity

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash occurs in the Gfx::decode bmp pixel data function, which is calle...

GLSA-202309-15 : GNU Binutils: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202309-15 GNU Binutils: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GNU Binutils. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2023-273-02)

The version of mozilla-thunderbird installed on the remote host is prior to 115.3.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-273-02 advisory. - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a...

Debian DSA-5510-1 : libvpx - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5510 advisory. Clement Lecigne discovered a heap-based buffer overflow in libvpx, a multimedia library for the VP8 and VP9 video codecs, which may result in the execution of arbitra...

Debian DSA-5509-1 : firefox-esr - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5509 advisory. A buffer overflow in VP8 media stream processing has been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For...

Debian dla-3591 : firefox-esr - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3591 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3591-1 [email protected] https://www.debian.org/lts/security/...

openSUSE 15 Security Update : chromium (openSUSE-SU-2023:0277-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0277-1 advisory. - Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI...

Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2023-5217 exists in the wild...

OSV-2023-930 Heap-buffer-overflow in OT::cvar::decompile_tuple_variations

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62774 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::cvar::decompiletuplevariations OT::cvar::subset bool trysubset...

[SECURITY] [DLA 3588-1] vim security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3588-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès September 29, 2023 https://wiki.debian.org/LTS -...

Update Chrome now! Google patches another actively exploited vulnerability

Google has updated the Stable Channel for Chrome to 117.0.5938.132 for Windows, Mac and Linux. This update includes ten security fixes. According to Google there is an active exploit for one of the patched vulnerabilities, which means cybercriminals are aware of the vulnerability and are using it...

OPENSUSE-SU-2023:0277-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium 117.0.5938.132 boo1215776: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx boo1215778 CVE-2023-5186: Use after free in Passwords CVE-2023-5187: Use after free in Extensions - Chromium 117.0.5938.92: stability improvemen...

Mozilla Thunderbird < 115.3.1

The version of Thunderbird installed on the remote Windows host is prior to 115.3.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-44 advisory. - Specific handling of an attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content process...

Mozilla Firefox Security Advisory (MFSA2023-44) - Linux

The remote host is missing an update for Mozilla Firefox, announced via the advisory MFSA2023-44. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

PT-2023-36040 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 2 crash has been reported. The crash involves the OT::cvar::decompile tuple variations and OT::cvar::subset functions, as wel...