UBUNTU-CVE-2017-16797

In SWFTools 0.9.2, the pngload function in lib/png.c does not properly validate an alloclen64 multiplication of width and height values, which allows remote attackers to cause a denial of service integer overflow, heap-based buffer overflow, and application crash or possibly have unspecified othe...

UBUNTU-CVE-2017-16794

The pngload function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file, as demonstrated by an erroneous...

CVE-2017-16663

In sam2p 0.49.4, there are integer overflows with resultant heap-based buffer overflows in input-bmp.ci in the function ReadImage, because "width height" multiplications occur unsafely...

CVE-2017-16663

In sam2p 0.49.4, there are integer overflows with resultant heap-based buffer overflows in input-bmp.ci in the function ReadImage, because "width height" multiplications occur unsafely...

UBUNTU-CVE-2017-16663

In sam2p 0.49.4, there are integer overflows with resultant heap-based buffer overflows in input-bmp.ci in the function ReadImage, because "width height" multiplications occur unsafely...

CVE-2017-16663

In sam2p 0.49.4, there are integer overflows with resultant heap-based buffer overflows in input-bmp.ci in the function ReadImage, because "width height" multiplications occur unsafely...

CVE-2017-15238

ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage...

Design/Logic Flaw

ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage...

CVE-2017-15238

ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage...

DEBIAN-CVE-2017-13140

In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service application hang in LockSemaphoreInfo via a PNG file with a width equal to MAGICKWIDTHLIMIT...

The vulnerability of the bmp2tiff component in the LibTIFF library allows a hacker to gain access to data beyond the buffer boundaries allocated in dynamic memory.

The vulnerability of the bmp2tiff component in the LibTIFF library arises from insufficient checking of the input parameters biWidth and biHeight in the bitmap-information header of the BMP image. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data beyo...

USN-3380-1 freerdp vulnerabilities

It was discovered that FreeRDP incorrectly handled certain width and height values. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS. CVE-2014-0250 It was discovered...

CVE-2017-12131

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens...

Tor: Scrollbar Width permits detecting browser platform

In April 2017 shortly before this bug bounty program went live, I repeatedly attempted to report this information disclosure vulnerability. However, my emails to the Tor Project's official vulnerability disclosure address went unanswered. It was not until I posted a public blog entry -- with a...

The vulnerability of the `gdImageWebPtr` function in the GD Graphics Library allows attackers to exert undefined effects.

The vulnerability of the gdImageWebPtr function in the GD Graphics Library is related to the repeated release of memory. Exploiting this vulnerability can allow an attacker, operating remotely, to cause unpredictable effects by using large values for width and height...

DEBIAN-CVE-2017-10799

When GraphicsMagick 1.3.25 processes a DPX image with metadata indicating a large width in coders/dpx.c, a denial of service OOM can occur in ReadDPXImage...

UBUNTU-CVE-2017-10799

When GraphicsMagick 1.3.25 processes a DPX image with metadata indicating a large width in coders/dpx.c, a denial of service OOM can occur in ReadDPXImage...

CVE-2017-9995

libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted file...

libquicktime Denial of Service Vulnerability (CNVD-2017-11753)

libquicktime is a library for reading and writing files in quicktime, avi and mp4 formats. A security vulnerability exists in the 'quicktimevideowidth' function of the lqtquicktime.c file in libquicktime version 1.2.4. A remote attacker can exploit this vulnerability to cause a denial of service...

Silicon Graphics LibTIFF Heap Buffer Overflow Vulnerability (CNVD-2017-07752)

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A heap buffer overflow vulnerability exists in bmp2tiff in Silicon Graphics LibTIFF version...