xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

lcms:cms_universal_transform_fuzzer: Use-of-uninitialized-value in PackPlanarWords

Project: https://github.com/mm2/Little-CMS.git Detailed Report: https://oss-fuzz.com/testcase?key=6355667052527616 Project: lcms Fuzzing Engine: libFuzzer Fuzz Target: cmsuniversaltransformfuzzer Job Type: libfuzzermsanlcms Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

PT-2022-37235 · Git +1 · Lcms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash involves the functions PackChunkyBytes,...

lcms:cms_universal_transform_fuzzer: Null-dereference READ in cmsDoTransform

Project: https://github.com/mm2/Little-CMS.git Detailed Report: https://oss-fuzz.com/testcase?key=6518259591020544 Project: lcms Fuzzing Engine: libFuzzer Fuzz Target: cmsuniversaltransformfuzzer Job Type: libfuzzerasanlcms Platform Id: linux Crash Type: Null-dereference READ Crash Address:...

DEBIAN-CVE-2022-3028

A race condition was found in the Linux kernel's IP framework for transforming packets XFRM subsystem when multiple calls to xfrmprobealgs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an...

lcms:cms_transform_all_fuzzer: Use-of-uninitialized-value in _LUTeval16

Project: https://github.com/mm2/Little-CMS.git Detailed Report: https://oss-fuzz.com/testcase?key=6539233157840896 Project: lcms Fuzzing Engine: libFuzzer Fuzz Target: cmstransformallfuzzer Job Type: libfuzzermsanlcms Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

lcms:cms_transform_all_fuzzer: Heap-buffer-overflow in _cmsMAT3per

Project: https://github.com/mm2/Little-CMS.git Detailed Report: https://oss-fuzz.com/testcase?key=5097571315482624 Project: lcms Fuzzing Engine: libFuzzer Fuzz Target: cmstransformallfuzzer Job Type: libfuzzerasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

MAL-2022-1409 Malicious code in babel-plugin-transfvrm-rvntime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a81b30912fad1ce99bf876e2494d9b453fb18c220c6bb64401b3ef47b177394 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1415 Malicious code in babel-pzugin-transform-es2015-modues-commonjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f487dcb86915ec1bb46550b2f2a4b5cc2d0deb6cdabc7fb8b3ca164467e27876 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babelplugintransfomreactremoveproptypes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 118d5e800455cde3fd9da5c424f41242c449f5bdb4665b9f989cffe0d63e215c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1420 Malicious code in babelllugintransformes2015modulescommonjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85a16e3db18168e71a2eeec8f9190a55ae782642089ef8b41719535a6a434a82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2022-38228

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc...

XPDF 缓冲区错误漏洞

XPDF is an open source PDF reader from FOO Labs. The product supports decoding files in LZW compressed format and reading encrypted PDF files. XPDF suffers from a buffer error vulnerability that stems from DCTStream::transformDataUnit in /xpdf/Stream.cc contains a heap buffer overflow...

AlmaLinux 8 : firefox (5777) (ALSA-2022:5777)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:5777 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102. Some of these bugs showed evidence of memory...

Oracle Linux 9 : firefox (ELSA-2022-5767)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-5767 advisory. 91.12.0-2.0.1 - Removed Upstream references 91.12.0-1 - Update to 91.12.0 build1 Tenable has extracted the preceding description block directly from th...

Oracle Linux 8 : thunderbird (ELSA-2022-5774)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-5774 advisory. 91.12.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 91.12.0-1 - Update to 91.12.0 build1 Tenable has...

Oracle Linux 8 : firefox (ELSA-2022-5777)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-5777 advisory. 91.12.0-2.0.1 - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 91.12.0-1 - Update to 91.12...

Mozilla: Mouse Position spoofing with CSS transforms

The Mozilla Foundation Security Advisory describes this flaw as: When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed...

Mozilla: Mouse Position spoofing with CSS transforms

The Mozilla Foundation Security Advisory describes this flaw as: When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed...