CVE-2018-3774: Direct Request

Incorrect parsing in url-parse 1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol...

Sandbox Breakout / Arbitrary Code Execution in static-eval

Affected versions of static-eval pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept js var evaluate = require'static-eval'; var parse = require'esprima'.parse; va...

Open Redirect

Overview Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery SSRF, or Bypass Authentication Protocol vulnerabilities. Recommendation Update to version 1.4.3 or later. References - HackerOne Report - GitHub Commit - GitHub...

UBUNTU-CVE-2018-5813

An error within the "parseminolta" function dcraw/dcraw.c in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file...

GHSA-Q75G-2496-MXPP Regular Expression Denial of Service in parsejson

Affected versions of parsejson are vulnerable to a regular expression denial of service when parsing untrusted user input. Recommendation The parsejson package has not been functionally updated since it was initially released. Additionally, it provides functionality which is natively included in...

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

Null pointer dereference

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

CVE-2018-14448

CVE-2018-14448 concerns the Untrunc project: a NULL pointer dereference in Codec::parse (track.cpp) when parsing a crafted MP4 file, caused by improper interaction with libav. This vulnerability affects Untrunc up to 2018-06-07 by design of the parser, and the issue is triggered during MP4 proces...

PT-2018-12525

Name of the Vulnerable Software and Affected Versions Untrunc through 2018-06-07 Description The issue arises from a NULL pointer dereference in the Codec::parse function, located in track.cpp, due to improper interaction with libav when processing a crafted MP4 file. Recommendations For Untrunc...

CVE-2018-14448: NULL Pointer Dereference

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

Node.js third-party modules: url-parse package return wrong hostname

Jul 19th 2018 - lolwaleet submitted a report to Node.js third-party modules. I would like to report url-parse package return wrong hostname in url-parse. Module module name: url-parse version: 1.4.1 npm page: https://www.npmjs.com/package/url-parse Module Description The url-parse method exposes...

PT-2018-12494

Name of the Vulnerable Software and Affected Versions axmldec version 1.2.0 Description The issue is related to an out-of-bounds write in the jitana::axml parser::parse start namespace function, located in lib/jitana/util/axml parser.cpp. Recommendations For axmldec version 1.2.0, at the moment,...

UBUNTU-CVE-2018-14015

The sdbsetinternal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service invalid read and application crash via a crafted ELF file because of missing input validation in rbindwarfparsecompunit in libr/bin/dwarf.c...

PT-2018-12279

Name of the Vulnerable Software and Affected Versions radare2 version 2.7.0 Description The issue is related to a denial of service caused by an invalid read and application crash. This occurs when a crafted ELF file is processed due to missing input validation in the r bin dwarf parse comp unit...

DEBIAN-CVE-2018-13845

An issue has been found in HTSlib 1.8. It is a buffer over-read in samparse1 in sam.c...

PT-2018-2904

Name of the Vulnerable Software and Affected Versions Secret Net Studio affected versions not specified Description The issue is related to errors in buffer offset calculation in the krb parse authz data function of the SnAuthRPC module, leading to dereferencing of unallocated memory. This can be...

PT-2018-2634

Name of the Vulnerable Software and Affected Versions libarchive versions 3.1.0 and later Description The issue is related to a double free error in the RAR decoder of the libarchive library, specifically in the parse codes function within libarchive/archive read support format rar.c. This error...