CentOS 8 : libxml2 (CESA-2023:0173)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0173 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several...

EulerOS 2.0 SP9 : ncurses (EulerOS-SA-2024-1182)

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Note that Tenable Network...

EulerOS 2.0 SP9 : giflib (EulerOS-SA-2024-1173)

According to the versions of the giflib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. CVE-2023-39742 Note that Tenable Network Security has...

EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2024-1148)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There exists one heap buffer overflow in TIFFmemcpy in tifunix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service throu...

Clorox counts the cost of cyberattack

Cleaning products maker Clorox has reported losses of $49 million in connection to a cyberattack it suffered in August of last year. On Monday, August 14, 2023, Clorox disclosed it had identified unauthorized activity on some of its IT systems. Despite a business continuity plan, the incident...

Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service

...

Denial Of Service

man2html is vulnerable to Denial Of Service. The vulnerability is due a specific string being read from a file which will overwrite the size parameter in the top chunk of the heap. This causes the program to segmentation abort which leads to Denial Of Service...

cras:cras_hfp_slc: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5351102929240064 Project: cras Fuzzing Engine: libFuzzer Fuzz Target: crashfpslc Job Type: libfuzzermsancras Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: memory MSAN Crash Revision:...

GLSA-202402-06 : FreeType: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202402-06 FreeType: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

cras:cras_hfp_slc: Segv on unknown address in std::__Fuzzer::pair<std::__Fuzzer::__hash_iterator<std::__Fuzzer::__hash_node<st

Detailed Report: https://oss-fuzz.com/testcase?key=6286549582938112 Project: cras Fuzzing Engine: libFuzzer Fuzz Target: crashfpslc Job Type: libfuzzermsancras Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple Tensorflow vulnerabilities.

Summary Multiple Tensorflow vulnerabilitiies have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-25662 DESCRIPTION: TensorFlow is vulnerable...

Fedora 38 : ncurses (2024-96090dafaf)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-96090dafaf advisory. Update to newer ncurses version, which fixes CVE-2023-29491 and CVE-2023-50495. Tenable has extracted the preceding description block directly from...

GLSA-202401-32 : libaom: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-32 libaom: Multiple Vulnerabilities - AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aomimage.c. CVE-2020-36129 - AOM v2.0.1 was discovered to contain a NULL pointer dereference via the...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : libde265 vulnerabilities (USN-6617-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6617-1 advisory. It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a...

zstd:dictionary_decompress: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5767923163529216 Project: zstd Fuzzing Engine: libFuzzer Fuzz Target: dictionarydecompress Job Type: libfuzzerasanzstd Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

LibTIFF Segmentation Error Vulnerability

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A segmentation error vulnerability exists in LibTIFF that stems from the presence of a segmentation error issue, which can be exploited by a...

libhevc:hevc_dec_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6689348804214784 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzerasani386libhevc Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...

cgif:cgif_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4618005531131904 Project: cgif Fuzzing Engine: libFuzzer Fuzz Target: cgiffuzzer Job Type: libfuzzerasani386cgif Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

pem:fuzz_pem: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4671327080349696 Project: pem Fuzzing Engine: libFuzzer Fuzz Target: fuzzpem Job Type: libfuzzerasanpem Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

AZL-43891 CVE-2023-52356 affecting package openjpeg2 2.3.1-12

A segment fault SEGV flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service...