Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update

A new image is available for Red Hat Single Sign-On 7.5.1, running on OpenShift Container Platform 3.10 and 3.11, and 4.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

CVE-2021-39252

A crafted NTFS image can cause an out-of-bounds read in ntfsielookup in NTFS-3G 2021.8.22...

GHSA-QRMM-W4V4-Q7F8 Unauthorized access through URL manipulation

Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. Patches The vulnerability has been patched in version 1.2.65 of the master branch, version 1.1.113 of the 1.1.x series, and version 1.0.12 of the stable branch. The Docker...

CVE-2020-9468

The CVE-2020-9468 issue concerns the Community plugin 2.9.e-beta for Piwigo. Affected: the plugin’s image information handling, where an attacker can set image metadata on images in albums they lack permission for by manipulating the image_id parameter. Root cause appears to be a permission check...

ImageMagick Memory Misreference Vulnerability (CNVD-2019-41001)

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A memory misreference vulnerability exists in TraceBezier in MagickCore/draw.c in versions of ImageMagick prior to 7.0.8-62. An attacker could exploit this vulnerabili...

Pixload - Image Payload Creating/Injecting Tools

Set of tools for creating/injecting payload into images. SETUP The following Perl modules are required: - GD - Image::ExifTool - String::CRC32 On Debian-based systems install these packages: sudo apt install libgd-perl libimage-exiftool-perl libstring-crc32-perl On OSX please refer to this...

CVE-2019-15640

Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image...

CVE-2019-14280

CVE-2019-14280 affects Craft CMS (versions prior to 2.7.10 and 3 prior to 3.2.6). The issue is an information disclosure where EXIF data is not stripped from user-uploaded images when configured to do so, potentially exposing personal/geolocation data. Red Hat and NVD entries reiterate the vulner...

DLA-1861-1 libsdl2-image - security update

Bulletin has no description...

DSA-4276-1 php-horde-image - security update

Bulletin has no description...

komoot.de XSS vulnerability

Open Bug Bounty ID: OBB-615057 Description| Value ---|--- Affected Website:| komoot.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DEBIAN-CVE-2017-11527

The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service memory consumption via a crafted file...

Fedora 26 : php-horde-Horde-Image (2017-28387b61fd)

HordeImage 2.5.1 - mjr SECURITY: Fix more potential places for command injections. ---- HordeImage 2.5.0 - mjr SECURITY: Prevent DOS attack by preventing an infinite loop in certain conditions CVE-2017-9773, reported by Fariskhi Vidyan. - mjr SECURITY: Prevent RCE attacks by properly sanitizing...

CVE-2015-8234

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision...

CVE-2016-7569

The CVE-2016-7569 entry concerns docker2aci before 0.13.0, where a directory traversal flaw lets remote attackers write to arbitrary files via .. in the embedded layer data of an image. Affected component: docker2aci (image conversion tool). Root cause: path traversal due to dot-dot in embedded l...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

Multiple vulnerabilities exist in the kernel-image-2.6.8-13-em64t-p4 operating system from Debian GNU/Linux. Exploitation of these vulnerabilities may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

OpenStack qemu-imge security bypass vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration and Rackspace, Inc. OpenStack qemu-imge is one of the installation images. A security bypass vulnerability exists in OpenStack qemu-imge. An attacker could use this vulnerability to...

MGASA-2015-0451 Updated libpng/libpng12 packages fix security vulnerability

Multiple buffer overflows in the pngsetPLTE and pnggetPLTE functions in libpng before 1.6.19 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a small bit-depth value in an IHDR aka image header chunk in a PNG image CVE-2015-8126...

[SECURITY] [DLA 343-1] libpng security update

Package : libpng Version : 1.2.44-1+squeeze5 CVE ID : CVE-2012-3425 CVE-2015-7981 CVE-2015-8126 CVE-2015-7981 Added a safety check in pngsettIME Bug report from Qixue Xiao. CVE-2015-8126 Multiple buffer overflows in the 1 pngsetPLTE and 2 pnggetPLTE functions in libpng before 1.0.64, 1.1.x and...

CVE-2012-2840

CVE-2012-2840 : In libexif, an off-by-one error in the exif_convert_utf16_to_utf8 function (exif-entry.c) below version 0.6.21 can be triggered by crafted EXIF tags in an image, potentially causing a denial of service or remote code execution. Multiple public advisories confirm the flaw and coord...