Double free

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc double free in sndrawmidiinputparams and sndrawmidioutputstatus which are part of sndrawmidiioctl handler in rawmidi.c file. A malicious local attacker could possibly use this f...

CVE-2018-10902

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc double free in sndrawmidiinputparams and sndrawmidioutputstatus which are part of sndrawmidiioctl handler in rawmidi.c file. A malicious local attacker could possibly use this f...

CVE-2018-10902

CVE-2018-10902 is a Linux kernel local privilege-escalation flaw in the raw MIDI driver. The issue arises from a race on concurrent access in the snd_rawmidi_ioctl() path (snd_rawmidi_input_params and snd_rawmidi_output_status), causing a double-free/double-realloc in the rawmidi.c handler. Explo...

CVE-2018-10902

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc double free in sndrawmidiinputparams and sndrawmidioutputstatus which are part of sndrawmidiioctl handler in rawmidi.c file. A malicious local attacker could possibly use this f...

CVE-2018-10902

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc double free in sndrawmidiinputparams and sndrawmidioutputstatus which are part of sndrawmidiioctl handler in rawmidi.c file. A malicious local attacker could possibly use this f...

UBUNTU-CVE-2018-10902

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc double free in sndrawmidiinputparams and sndrawmidioutputstatus which are part of sndrawmidiioctl handler in rawmidi.c file. A malicious local attacker could possibly use this f...

openstack-nova: Swapping encrypted volumes can allow an attacker to corrupt the LUKS header causing a denial of service in the host

OpenStack Nova has a vulnerability in the handling of encrypted volumes. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. All Nova installations supporting...

OWA for hackers: ExchangeRelayX

ExchangeRelayX is a PoC tools to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking interface, with...

Denial Of Service (DoS) Through Out-of-Bounds Read

libraw.so is vulnerable to denial of service DoS attacks. A malicious user can pass a RAW file to the samsungloadraw function in dcraw.c to cause a out-of-bounds read that can crash the application...

UBUNTU-CVE-2018-5810

An error within the "rolleiloadraw" function internal/dcrawcommon.cpp in LibRaw versions prior to 0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash...

UBUNTU-CVE-2018-5807

An error within the "samsungloadraw" function internal/dcrawcommon.cpp in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash...

CVE-2018-5810

A heap-based buffer overflow has been discovered in LibRaw, in the way rolleiloadraw function in internal/dcrawcommon.cpp file handles the input image. An attacker could trigger the flaw by providing a specially crafted Rollei RAW Image, which could result in a crash or other unspecified effects...

Libsixel Memory Disclosure Vulnerability

libsixel is a SIXEL encoder/decoder implementation. The 'sixeldecoderdecode' function in the decoder.c file, the 'imagebufferresize' function in the fromsixel.c file, and the 'sixeldecoderaw' function in the fromsixel.c file in libsixel version 1.8.1. ' function, 'imagebufferresize' function of t...

DEBIAN-CVE-2018-14072

libsixel 1.8.1 has a memory leak in sixeldecoderdecode in decoder.c, imagebufferresize in fromsixel.c, and sixeldecoderaw in fromsixel.c...

UBUNTU-CVE-2018-14072

libsixel 1.8.1 has a memory leak in sixeldecoderdecode in decoder.c, imagebufferresize in fromsixel.c, and sixeldecoderaw in fromsixel.c...

LibRaw 'kodak_radc_load_raw' function out-of-bounds read vulnerability

LibRaw is a C++ library for processing RAW CRW/CR2, NEF, RAF, DNG and others format images. An out-of-bounds read vulnerability exists in the 'kodakradcloadraw' function internal/dcrawcommon.cpp file in LibRaw versions prior to 0.18.7. An attacker can exploit this vulnerability with a specially...

LibRaw 'LibRaw::kodak_ycbcr_load_raw()' function heap buffer overflow vulnerability

LibRaw is a C++ library developed by the LibRaw team for processing RAW CRW/CR2, NEF, RAF, DNG and others format images. A heap buffer overflow vulnerability exists in the 'LibRaw::kodakycbcrloadraw' function in versions prior to LibRaw 0.18.7 file internal/dcrawcommon.cpp. An attacker could...

[SECURITY] Fedora 28 Update: dcraw-9.28.0-1.fc28

This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras...

Denial Of Service (DoS)

libraw.so is vulnerable to denial of service DoS attacks.A malicious user can pass a RAW file to the quicktake100loadraw function in dcrawcommon.cpp to cause a buffer overflow, leading to an application to crash...

[SECURITY] Fedora 27 Update: LibRaw-0.18.12-1.fc27

LibRaw is a library for reading RAW files obtained from digital photo cameras CRW/CR2, NEF, RAF, DNG, and others. LibRaw is based on the source codes of the dcraw utility, where part of drawbacks have already been eliminated and part will be fixed in future...