CVE-2019-5060

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap...

CVE-2019-5060

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap...

CVE-2019-5059

CVE-2019-5059 describes an exploitable code execution in SDL2_image 2.0.4 via XPM image rendering caused by an integer overflow that allocates too small a heap buffer and allows out-of-bounds writes. Connected advisories (Mageia/OpenSUSE OSV) document that SDL2_image 2.0.4 is the affected version...

CVE-2019-5058

CVE-2019-5058 affects SDL2_image 2.0.4, where the XCF image rendering functionality can trigger a heap overflow via a crafted XCF image, potentially enabling code execution. Public documents in OSS advisories (MGASA-2019-0363/0364 and OSV entries) link this CVE to SDL2_image and describe the vuln...

CVE-2019-5058

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability...

USN-4081-1: Pango vulnerability

It was discovered that Pango incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...

Cross-site Scripting (XSS)

invenio-previewer is vulnerable to cross-site scripting XSS. It does not escape the user-uploaded file and directly render the file in the JSON, Markdown and iPython Notebook previewers, allowing an attacker to inject arbitrary Javascript into a victim's browser using a malicious file...

SDL_image XCF Image Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. Tested...

Improper sanitization of HTML in directory names (NC-SA-2019-009)

Some basic HTML tags were rendered as Markup in directory names...

Design/Logic Flaw

While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI behaviour in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer...

Code injection

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

Cross-site scripting invenio-records

Cross-Site Scripting XSS vulnerability in administration interface Impact A Cross-Site Scripting XSS vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to insecure privilege management, allows attackers to execute arbitrary code.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web page...

The vulnerability in the UIProcess subsystem of the rendering module in WebKitGTK+ and WebKitGTK allows a attacker to cause a service failure or affect the confidentiality and integrity of the protected information.

The vulnerability of the UIProcess subsystem in display modules of WebKitGTK+ and WebKitGTK arises from operations that occur outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or compromise the confidentiality and integrity of...

Updated dosbox package fixes security vulnerabilities

Dosbox 0.74-3 is a security release: Fixed that a very long line inside a bat file would overflow the parsing buffer. CVE-2019-7165 by Alexandre Bartel Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc e.g. /proc/self/mem when / or /proc we...

MGASA-2019-0205 Updated dosbox package fixes security vulnerabilities

Dosbox 0.74-3 is a security release: Fixed that a very long line inside a bat file would overflow the parsing buffer. CVE-2019-7165 by Alexandre Bartel Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc e.g. /proc/self/mem when / or /proc we...

Fedora Update for poppler FEDORA-2019-0ea42f074e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: poppler-0.67.0-21.fc29

poppler is a PDF rendering library...

MGASA-2019-0194 Updated graphicsmagick packages fix security vulnerabilities

GraphicsMagick 1.3.32 is now released, fixing another 52 additional issues detected by oss-fuzz. Of special mention is a bug reported to us by "Battle Furry" via our security mail alias. This bug was considered to be a "feature" allows including file text as rendered text on a graphic image, or a...

e107 <= 2.2.1 XSS Vulnerability

e107 is prone to a cross-site scripting XSS vulnerability via e107admin/comment.php. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...