CVE-2022-41419

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4Processor::Process function in the mp4encrypt binary...

UBUNTU-CVE-2022-41425

Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4Processor::ProcessFragments function in mp4decrypt...

PT-2022-25859

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0-639 Description A segmentation violation was discovered in the AP4 Processor::ProcessFragments function in mp4decrypt, which is part of Bento4. Recommendations For Bento4 version 1.6.0-639, consider avoiding the use of the...

Bento4 security vulnerabilities

Bento4 is an open source C library for reading and writing MP4 files. version v1.6.0-639 of Bento4 contains a denial of service vulnerability that stems from a memory leak in the AP4Processor::Process function in the mp4encrypt binary. An attacker could exploit the vulnerability to cause a denial...

PT-2022-25855

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0-639 Description A memory leak was discovered in Bento4 via the AP4 Processor::Process function in the mp4encrypt binary. Recommendations For version 1.6.0-639, consider restricting the use of the AP4 Processor::Process...

Improper beacon events in matrix-js-sdk can result in availability issues

Impact Improperly formed beacon events from MSC3488 can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data...

UBUNTU-CVE-2022-39236

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the...

UBUNTU-CVE-2021-43980

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 tha...

Apache Tomcat race condition vulnerability

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements support for Servlets and JavaServer Page JSP. A security vulnerability exists in Apache Tomcat, which stems from a simplified implementation of blocking reads and writes, wi...

Carlo Gavazzi UWP path traversal vulnerability

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. It is used for applications such as building automation, energy efficiency performance management and parking lot guidance. A path traversal vulnerability exists in Carlo Gavazzi UWP 3.0, which can be exploit...

Security Bulletin: A vulnerability in FasterXML Woodstox affects IBM Tivoli Business Service Manager (220573)

Summary FasterXML Woodstox is shipped with IBM Tivoli Business Manager 6.2.0 as part of its XML processor insfrastructure. Information about security vulnerabilities affecting FasterXML Woodstox has been published in a security bulletin. Vulnerability Details IBM X-Force ID: 220573 DESCRIPTION:...

OSV-2022-943 UNKNOWN WRITE in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51695 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

PT-2022-37301 · Perfetto · Perfetto

Name of the Vulnerable Software and Affected Versions: perfetto affected versions not specified Description: The issue is related to a crash in the perfetto trace processor. The crash occurs in the TrackEventParser::ParseTrackDescriptor function, which is called by TrackEventModule::ParsePacket a...

PT-2025-40728

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-rc7+ Description The Linux kernel contains an issue where using smp processor id can lead to a kernel crash when CPU 0 is offline and intel powerclamp is used to inject idle. This occurs because the functi...

PT-2022-33922

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.61 Description A refcount leak bug was discovered in the display component of the OMAP2+ ARM processor. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2022:3282-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3282-1 advisory. The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs wer...

PT-2022-33947

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15.17 through v5.15.60 Description The issue is related to the use of smp processor id in a preemptible context in the kexec functionality of the RISC-V architecture. The actual impact and attack plausibility have not...

PT-2022-34076 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to the assignment of scpi info in the arm scpi firmware when a probe fails. The actual impact and potential for attack have not been proven yet. Recommendations: For...

PT-2022-33628

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.19.2 Description The issue is related to the use of smp processor id in a preemptible context in the kexec functionality of the RISC-V architecture. The actual impact and attack plausibility have not yet been...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...