Insecure Encryption

Overview parsel is a gem to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. It contains a weak key derivation function, in which a key of arbitrary length is run through one round of SHA256 to gain key material of the correct...

XML External Entity

Overview Affected versions of this package are vulnerable to XML External Entity. The XmlScanner decodes the sheet1.xml from an .xlsx to UTF-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound. An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, whi...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. An issue was discovered in libSDL2.a in Simple DirectMedia Layer SDL 2.0.9 when used in conjunction with libSDL2image.a in SDL2image 2.0.4. There is a NULL pointer dereference in the SDL2image function...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. An issue was discovered in libSDL2.a in Simple DirectMedia Layer SDL 2.0.9 when used in conjunction with libSDL2image.a in SDL2image 2.0.4. There is a heap-based buffer overflow in the SDL2image function IMGLoadPCXR...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds. An issue was discovered in libSDL2.a in Simple DirectMedia Layer SDL 2.0.9 when used in conjunction with libSDL2image.a in SDL2image 2.0.4. There is a SEGV in the SDL function SDLfreeREAL at stdlib/SDLmalloc.c. Remediatio...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to for example the pdfimages binar...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. PoDoFo::Impose::PdfTranslator::setSource in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can for example be triggered by sending a crafted PDF file to the podofoimpose binary. It allows...

Unsafe Dependency Resolution

Overview com.paypal.digraph:digraph-parser is a Java parser for digraph DSL Graphviz DOT language. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a...

Unsafe Dependency Resolution

Overview com.uber:UberScriptQuery is a SQL-like DSL to make writing Spark jobs super easy. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds. The SingleDocParser::HandleFlowMap function in yaml-cpp aka LibYaml-C++ 0.6.2 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file. Remediation Upgrade...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. An issue has been found in libIEC61850 v1.3. It is a SEGV in EthernetreceivePacket in ethernetbsd.c. Remediation There is no fixed version for libiec61850. References - Github.com - GitHub Issue...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSetgetValues in client/iedconnection.c. Remediation There is no fixed version for libiec61850. References - Github.com ...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. In Poppler 0.68.0, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. Details Denial of Service DoS describes a family o...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure. Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h. Remediation There is no fixed version for tinyexr. References - GitHub Issue...