68 matches found
UBUNTU-CVE-2023-52816
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix shift out-of-bounds issue 567.613292 shift exponent 255 is too large for 64-bit type 'long unsigned int' 567.614498 CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic 3422.04.1-Ubuntu 567.614502...
CVE-2023-46256 PX4-Autopilot Heap Buffer Overflow Bug
PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of parserbufindex value checking. A malfunction of the sensor device can cause a heap buffer overflow...
CVE-2023-46256 PX4-Autopilot Heap Buffer Overflow Bug
PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of parserbufindex value checking. A malfunction of the sensor device can cause a heap buffer overflow...
CVE-2022-36153
tifig v0.2.2 was discovered to contain a segmentation violation via std::vector ::size const at /bits/stlvector.h...
CVE-2022-36153
CVE-2022-36153 affects tifig v0.2.2, where a segmentation violation can occur through the use of std::vector::size() in /bits/stl_vector.h. The issue is documented across multiple sources (NVD entry and Red Hat/OSV/CVE lists) consistently describing a memory/segmentation fault in tifig 0.2.2. The...
CVE-2022-36153
tifig v0.2.2 was discovered to contain a segmentation violation via std::vector ::size const at /bits/stlvector.h...
CVE-2022-36153
tifig v0.2.2 was discovered to contain a segmentation violation via std::vector ::size const at /bits/stlvector.h...
OSV-2021-1518 UNKNOWN READ in bool OT::OffsetTo<OT::ClipBox, OT::IntType<unsigned int, 3u>, true>::serialize_c
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40540 Crash type: UNKNOWN READ Crash state: bool OT::OffsetTo, true::serializec OT::ClipList::serializecliprecords OT::ClipList::subset...
OSV-2021-977 Dynamic-stack-buffer-overflow in std::__1::pair<unsigned int, unsigned int>::pair<unsigned int, unsigned int, fal
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36062 Crash type: Dynamic-stack-buffer-overflow WRITE 4 Crash state: std::1::pair::pair::type, std::1::unw void GFWX::decode...
OESA-2021-1148 ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...
CVE-2020-27768
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0...
CVE-2020-27768
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0...
UBUNTU-CVE-2020-27768
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0...
CVE-2020-27768
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0...
CVE-2020-27768
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0...
OSV-2018-162 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10948 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat1::drivercontextt::drivercontextt...
OSV-2018-149 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11033 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int AAT::KerxSubTableFormat2::sanitize hbsanitizecontextt::returnt AAT::KerxTable::dispatch...
OSV-2018-116 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11060 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...
OSV-2018-91 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10881 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::kern::hasdata hbotlayouthaskerning...
OSV-2018-64 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11522 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int void hbsanitizecontextt::setobject::sanitize...