CVE-2025-8584 libav AVI File Parser buffer.c av_buffer_unref null pointer dereference

A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function avbufferunref of the file libavutil/buffer.c of the component AVI File Parser. The manipulation leads to null pointer dereference. Local access is required to approach this...

CVE-2025-8584 libav AVI File Parser buffer.c av_buffer_unref null pointer dereference

A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function avbufferunref of the file libavutil/buffer.c of the component AVI File Parser. The manipulation leads to null pointer dereference. Local access is required to approach this...

CVE-2025-8584

A vulnerability in libav up to 12.3 affects av_buffer_unref in libavutil/buffer.c (AVI File Parser), causing a NULL pointer dereference. Local access is required. The exploit is publicly disclosed and has PROOF-OF-CONCEPT maturity. The bug affects products no longer maintained; no remediation det...

FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Impact This is a significant Denial of Service DoS vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to...

GHSA-JXHH-4648-VPP3 FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Impact This is a significant Denial of Service DoS vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to...

Prototype Pollution

Overview js-toml is an A TOML parser for JavaScript/TypeScript, targeting TOML 1.0.0 Spec Affected versions of this package are vulnerable to Prototype Pollution via the parsing process. An attacker can inject or modify properties on the global Object.prototype by supplying specially crafted TOML...

CVE-2025-54803

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803

CVE-2025-54803 affects the JavaScript TOML parser js-toml . Vulnerable versions are those below 1.0.2 , where parsing a specially crafted TOML input can enable a prototype pollution attack that allows an attacker to add or modify properties on the global Object.prototype . The impact can range fr...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

js-toml 安全漏洞

js-toml is a TOML parser for JavaScript by Sunny Personal Developer. A security vulnerability exists in versions of js-toml prior to 1.0.2, which stems from a prototype contamination vulnerability that could lead to modification of the global Object.prototype property...

libav 安全漏洞

Libav is a cross-platform solution for recording and converting audio and video from the Libav team that includes a libavcodec encoder. A security vulnerability exists in libav 12.3 and earlier versions, which stems from a null pointer dereference in the function ffseekframebinary in the file...

PT-2025-31945 · Libav · Libav

Name of the Vulnerable Software and Affected Versions: libav versions up to 12.3 Description: A problematic issue exists in libav due to a null pointer dereference in the av buffer unref function within the libavutil/buffer.c file of the AVI File Parser component. Local access is required for...

PT-2025-31955 · Libav · Libav

Name of the Vulnerable Software and Affected Versions: libav versions up to 12.3 Description: A problematic issue exists in libav due to a null pointer dereference in the ff seek frame binary function within the /libavformat/utils.c file of the MPEG File Parser component. The issue is exploitable...

libav 安全漏洞

Libav is a cross-platform solution for recording and converting audio and video from the Libav team that includes a libavcodec encoder. A security vulnerability exists in libav 12.3 and earlier versions, which stems from a null pointer dereference in the function avbufferunref in the file...

SUSE CVE-2025-5030

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated...

SUSE-SU-2025:02597-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705...

Security update for python311

This update for python311 fixes the following issues: CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705. Update to 3.11.13: Security gh-135034: Fixes multiple issues that allowed tarfile extraction filters filter="data...

Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...