LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

SummaryA Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and...

CVE-2026-33626: Server-Side Request Forgery (SSRF)

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery SSRF vulnerability in LMDeploy's vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating...

lmdeploy 安全漏洞

lmdeploy is a toolkit developed by InternLM for compressing, deploying, and serving LLMs. Versions of LMDeploy prior to 0.12.3 contained security vulnerabilities; these vulnerabilities stemmed from the vision-language module’s loadimage function, which did not validate URLs, potentially allowing...

EUVD-2018-13357

Malware in sbrugna...

EUVD-2018-13099

Malware in sbrugna...

SUSE SLED12 / SLES12 Security Update : libcaca (SUSE-SU-2019:2745-1)

This update for libcaca fixes the following issues : Security issues fixed : CVE-2018-20544: Fixed a floating point exception at caca/dither.c bsc1120502 CVE-2018-20545: Fixed a WRITE memory access in the loadimage function at common-image.c for 4bpp bsc1120584 CVE-2018-20546: Fixed a READ memory...

Buffer Overflow

QEMU is vulnerable to buffer overflows. A remote, unauthenticated attacker could cause a system crash due to device tree size manipulation before buffer allocation leading to denial of service conditions. Affected by this issue is the function loadimage of the file devicetree.c...

Buffer overflow

In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk...

DEBIAN-CVE-2018-20815

In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk...

CVE-2018-20815

In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk...

CVE-2018-20545

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 4bpp data...

CVE-2018-20548

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 1bpp data...

CVE-2018-20548

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 1bpp data...

CVE-2018-20545

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 4bpp data...

CVE-2018-20548

CVE-2018-20548 : In libcaca, there is an illegal WRITE memory access in load_image (common-image.c) when processing 1bpp data in version 0.99.beta19. The FreeBSD VuXML entry confirms this CVE within a set of libcaca memory-access issues. Several vendor advisories (SUSE/openSUSE/Fedora/SLE) docume...

CVE-2018-20548

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 1bpp data...

UBUNTU-CVE-2018-20545

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 4bpp data...

CVE-2018-20545

There is an illegal WRITE memory access at common-image.c function loadimage in libcaca 0.99.beta19 for 4bpp data...

CVE-2017-17784

In GIMP 2.8.22, there is a heap-based buffer over-read in loadimage in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data...

CVE-2017-17784

In GIMP 2.8.22, there is a heap-based buffer over-read in loadimage in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data...