MGASA-2025-0227 Updated rootcerts, nspr, nss & firefox packages fix vulnerabilities

JavaScript engine only wrote partial return value to stack. CVE-2025-8027 Large branch table could lead to truncated instruction. CVE-2025-8028 Javascript: URLs executed on object and embed tags. CVE-2025-8029 Potential user-assisted code execution in “Copy as cURL” command. CVE-2025-8030 Incorre...

Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

...

PT-2025-35753

Name of the Vulnerable Software and Affected Versions: PDF for WPForms versions through 6.2.1 Description: The software contains a cross-site scripting XSS vulnerability due to improper neutralization of input during web page generation. This allows for stored XSS attacks. Recommendations: Update...

Linux Distros Unpatched Vulnerability : CVE-2022-43071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack overflow in the Catalog::readPageLabelTree2Object function of XPDF v4.04 allows attackers to cause a Denial of Service DoS via a crafted PDF file...

CLSA-2025-1756409595 clamav: Fix of 4 CVEs

Update to 1.4.3 LTS - CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser - CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser - CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser - CVE-2024-20506: Changed...

Linux Distros Unpatched Vulnerability : CVE-2022-24107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. CVE-2022-24107 Note that Nessus relies on the presence of the package as reported by the...

Linux Distros Unpatched Vulnerability : CVE-2022-38237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan at /xpdf/Stream.cc. CVE-2022-38237 Note that Nessus relies on the...

Badaso CMS file upload vulnerability

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload,...

CVE-2025-57810 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG...

IBM MQ Redistributable Client Installed (Linux)

Binary data ibmmqclientportablenixinstalled.nbin...

IBM MQ Redistributable Client Detection (Windows)

Binary data ibmmqclientportablewininstalled.nbin...

PT-2025-34787 · Jspdf · Jspdf

Name of the Vulnerable Software and Affected Versions: jsPDF versions prior to 3.0.2 Description: jsPDF is a JavaScript library used to generate PDFs. Prior to version 3.0.2, user control over the first argument of the addImage method can lead to high CPU utilization and denial of service...

IBM MQIPT Redistributable Installed (Windows)

Binary data ibmmqiptportablewininstalled.nbin...

IBM MQIPT Redistributable Installed (Linux)

Binary data ibmmqiptportablenixinstalled.nbin...

Linux Distros Unpatched Vulnerability : CVE-2018-11379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The getdebuginfo function in radare2 2.5.0 allows remote attackers to cause a denial of service heap- based out-of-bounds read and application crash via a craft...

Linux Distros Unpatched Vulnerability : CVE-2018-20751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in croppage in PoDoFo 0.9.6. For a crafted PDF document, pPage-GetObject-GetDictionary.AddKeyPdfNameMediaBox,var can be problematic due ...

Vulnerabilities fixed in Foxit Reader

Foxit has fixed vulnerabilities in Foxit Reader Specific to version 2025.1.0.27937. The vulnerabilities are in the way Foxit Reader handles PDF files. Malicious parties can exploit these vulnerabilities by tricking users into opening a malicious PDF file or visiting a malicious website, which can...

Denial Of Service (DoS)

setasign/fpdi is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of user-supplied PDF files, which allows an attacker to upload a crafted malicious PDF that leads to memory exhaustion and server crash...

Linux Distros Unpatched Vulnerability : CVE-2017-7383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a...

CVE-2025-9394 PoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use after free

A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host...