PT-2025-34262 · Git · Clamav

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429489013 Crash type: Invalid-free Crash state: cli pdf cli scanpdf cli magic scan...

OSV-2025-512 Invalid-free in pdf_decodestream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754704 Crash type: Invalid-free Crash state: pdfdecodestream pdfextractobj clipdf...

PT-2025-34466 · Git · Clamav

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754704 Crash type: Invalid-free Crash state: pdf decodestream pdf extract obj cli pdf...

SUSE CVE-2025-5899

A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parsevariablesoption of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached...

CVE-2023-22291

An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to an attempt to free a stack pointer, which causes memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2021-45262

An invalid free vulnerability exists in gpac 1.1.0 via the gfsgcommanddel function, which causes a segmentation fault and application crash...

CVE-2021-45263

An invalid free vulnerability exists in gpac 1.1.0 via the gfsvgdeleteattributevalue function, which causes a segmentation fault and application crash...

CVE-2020-36404

Keystone Engine 0.9.2 has an invalid free in llvmks::SmallVectorImpl::SmallVectorImpl...

nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC

Impact Decoding a specifically formed message can cause invalid free or realloc calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the...

GHSA-7MV5-5MXH-QG88 nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC

Impact Decoding a specifically formed message can cause invalid free or realloc calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the...

curl: CVE-2024-6197: freeing stack buffer in utf8asn1str

The libcurl library at commit 04739054cdac5a0614fb94e3655e313c03399f35 contained an invalid invocation of the free function in the utf8asn1str function. The buffer being freed was located on the stack, which posed a security risk as the freed address could have been later returned by malloc calls...

RHEL 5 : qffmpeg (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - qffmpeg: Invalid free in libavcodec/shorten.c due to invalid channel count CVE-2013-0873 - qffmpeg: out o...

RHEL 7 : ed (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ed: Invalid free in regex.c CVE-2017-5357 Note that Nessus has not tested for this issue but has instead relied on...

Advisory ROSA-SA-2024-2419

software: heimdal 7.8.0 WASP: ROSA-CHROME packageevrstring: heimdal-7.8.0-1 CVE-ID: CVE-2021-44758 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: heimdal allowed attackers to cause null pointer dereferencing in the SPNEGO receiver via the preferredmechtype GSSCNOOID and a non-zero initialresponse value f...

RHEL 7 : uriparser (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - uriparser: Out-of-bounds read in uriParseEx CVE-2018-20721 - An issue was discovered in uriparser before...

CVE-2024-26932 usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpmportunregisterpd When unregister pd capabilitie in tcpm, KASAN will capture below double -free issue. The root cause is the same capabilitiy will be kfreed twice, the first time is...

Low: uriparser

Issue Overview: An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. CVE-2021-46142 Affected Packages: uriparser Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2...

OSV-2023-1163 Invalid-free in sc_file_clear_acl_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64181 Crash type: Invalid-free Crash state: scfileclearaclentries scfilefree setcoscreatekey...

PT-2023-35586 · Git +1 · Opensc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Invalid-free. The crash state involves several function calls, including sc file clear acl entries, sc...

GLSA-202310-06 : Heimdal: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202310-06 Heimdal: Multiple Vulnerabilities - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerberos delegation model includes a feature allowing for a...