Denial Of Service (DoS)

imagemagick is vulnerable to denial of service. A division by zero can lead to outside the range of representable value in MagickCore/geometry.c and signed integer overflow in MagickCore/decorate.c...

[ASA-202011-19] libass: arbitrary code execution

Arch Linux Security Advisory ASA-202011-19 ========================================== Severity: Medium Date : 2020-11-19 CVE-ID : CVE-2020-26682 Package : libass Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1285 Summary ======= The package libass before...

CVE-2020-26682

In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow...

Integer overflow

In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow...

CVE-2020-26682

In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow...

CVE-2020-26682

CVE-2020-26682 affects libass 0.14.0, where the call to outline_stroke inside ass_outline_construct can trigger a signed integer overflow. This vulnerability may cause a crash or, per multiple advisories, could enable arbitrary code execution under certain conditions. Several connected sources no...

CVE-2020-26682

In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow...

CVE-2020-26682: Integer Overflow or Wraparound

In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow...

Fix of 227 CVE

Fix bug 69720: Null pointer dereference in phargetfpoffset - Fix bug 70728: Type Confusion Vulnerability in PHPtoXMLRPCworker - Fix bug 70661: Use After Free Vulnerability in WDDX Packet Deserialization - Fix bug 70741: Session WDDX Packet Deserialization Type Confusion Vulnerability - Fix bug...

PT-2020-16484

Name of the Vulnerable Software and Affected Versions libass version 0.14.0 Description The issue is caused by a signed integer overflow in the ass outline construct function's call to outline stroke. Recommendations For libass version 0.14.0, consider disabling the ass outline construct function...

EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-1269)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In the tun subsystem in the Linux kernel before 4.13.14, devgetvalidname is not called before registernetdevice. This allows loca...

MGASA-2020-0040 Updated libjpeg packages fix security vulnerabilities

The updated packages fix security vulnerabilities: A signed integer overflow and subsequent segfault that occurred when attempting to decompress images with more than 715827882 pixels using the 64-bit C version of TJBench. Out-of-bounds write in tjDecompressToYUV2 and tjDecompressToYUVPlanes...

PT-2020-22788

Name of the Vulnerable Software and Affected Versions TurboJPEG versions prior to 2.0.2 Description The issue involves several security vulnerabilities in the TurboJPEG library, including a signed integer overflow and subsequent segfault when decompressing images with more than 715827882 pixels...

CVE-2019-18805

An issue was discovered in net/ipv4/sysctlnetipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcpinput.c signed integer overflow in tcpackupdatertt when userspace writes a very large integer to /proc/sys/net/ipv4/tcpminrttwlen, leading to a denial of service or possibly unspecified...

CVE-2019-18805

An issue was discovered in net/ipv4/sysctlnetipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcpinput.c signed integer overflow in tcpackupdatertt when userspace writes a very large integer to /proc/sys/net/ipv4/tcpminrttwlen, leading to a denial of service or possibly unspecified...

CVE-2019-17042: Improper Input Validation

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter in this case, a space or a colon, but fails to account for strings that do not satisfy this constraint. If...

FreeBSD : bro -- NULL pointer dereference and Signed integer overflow (f56669f5-d799-4ff5-9174-64a6d571c451)

Jon Siwek of Corelight reports : This is a security patch release to address potential Denial of Service vulnerabilities : - NULL pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. - Signed integer overflow in BinPAC-generat...

QEMU: device_tree: heap buffer overflow while loading device tree blob

A heap buffer overflow issue was found in the loaddevicetree function of QEMU, which is invoked to load a device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type. A user/process could use this flaw to potential...

QEMU: device_tree: heap buffer overflow while loading device tree blob

A heap buffer overflow issue was found in the loaddevicetree function of QEMU, which is invoked to load a device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type. A user/process could use this flaw to potential...

QEMU: device_tree: heap buffer overflow while loading device tree blob

A heap buffer overflow issue was found in the loaddevicetree function of QEMU, which is invoked to load a device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type. A user/process could use this flaw to potential...