1717 matches found
JLSEC-2025-112 FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may...
FFmpeg =4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution...
JLSEC-2025-131 FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the `ff_gaussian_blur_8`...
FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ffgaussianblur8 function in libavfilter/edgetemplate.c:116:5 component...
JLSEC-2025-100 A flaw was found in the SFTP server message decoding logic of libssh
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash,...
JLSEC-2025-82 libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation...
libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when...
JLSEC-2025-76 Possible cross-site scripting vulnerability in libxml after commit 960f0e2.
Possible cross-site scripting vulnerability in libxml after commit 960f0e2...
JLSEC-2025-51 Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function...
JLSEC-2025-59 libexpat through 2.5.0 allows recursive XML Entity Expansion if `XML_DTD` is undefined at compile...
libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...
JLSEC-2025-63 An issue was discovered in libexpat before 2.6.3
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms where UINTMAX equals SIZEMAX...
JLSEC-2025-50 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for...
Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES...
JLSEC-2025-40 Header injection/Response splitting via header construction.
HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. using HTTP, Sockets function handleindexreq::HTTP.Request @show HTTP.headerreq, "X-Foo" return HTTP.Response200, "ok" end function handleredirectreq::HTTP.Request retu...
JLSEC-2025-23 Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when...
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data...
JLSEC-2025-15 An issue was discovered in cairo 1.16.0
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c...
JLSEC-2025-10 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a...
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service crash via a crafted bzip2 file, related to block ends set to before the start of the block...
JLSEC-2026-1386
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...
JLSEC-2026-1331
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...
JLSEC-2026-1336
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often...
JLSEC-2026-1340
When curl = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instea...
JLSEC-2026-1327 In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to...
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension...
JLSEC-2026-1305
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception FPE due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata...
JLSEC-2026-1315 Exiv2 has quadratic performance in ICC profile parsing in `JpegBase::readMetadata`
Impact A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of imag...
JLSEC-2026-1292
cfginit in confuse.c in libConfuse 3.2.2 has a memory leak...
JLSEC-2026-1273
ModularSquareRoot in Crypto++ aka cryptopp through 8.9.0 allows attackers to cause a denial of service infinite loop via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853...
JLSEC-2026-1245 A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used...
A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used with the GREGEXRAW compile flag and case-change replacement escapes because the stringappend function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the stri...
JLSEC-2026-1228
libexpat before 2.8.2 has an integer overflow in addBinding...
JLSEC-2026-1225
libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur similar to the CVE-2026-50219 situation...
JLSEC-2026-1217 libcurl would reuse a previously created connection even when some mTLS config related option had...
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...
JLSEC-2026-1117
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits causes out-of-bounds write. It is possible to initiate the attack remotely. T...
JLSEC-2026-1113
An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...
JLSEC-2026-896
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow...
JLSEC-2026-973 ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-siz...
JLSEC-2026-889
A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...
JLSEC-2026-1007 ImageMagick: Policy Bypass in PSD decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would...
JLSEC-2026-886
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from...
JLSEC-2026-977 ImageMagick has a Path Policy TOCTOU symlink race bypass
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This...
JLSEC-2026-984 ImageMagick has heap-based buffer overflow in UHDR encoder
A heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write. ================================================================ ==2158399==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x521000039500 at pc...
JLSEC-2026-860
A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but could...
JLSEC-2026-828
ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c...
JLSEC-2026-836
In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c...
JLSEC-2026-926 ImageMagick BlobStream Forward-Seek Under-Allocation
Reporter: Lumina Mescuwa Product: ImageMagick 7 MagickCore Component: MagickCore/blob.c Blob I/O - BlobStream Tested: 7.1.2-0 source tag and 7.1.2-1 Homebrew, macOS arm64, clang-17, Q16-HDRI Impact: Heap out-of-bounds WRITE attacker-controlled bytes at attacker-chosen offset → memory corruption;...
JLSEC-2026-992 ImageMagick has an Out-of-bounds Write via InterpretImageFilename
Due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write. ================================================================= ==48558==ERROR: AddressSanitizer: stack-buffer-overflow o...
JLSEC-2026-827
ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c...
JLSEC-2026-893
A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service...
JLSEC-2026-895
In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30...
JLSEC-2026-884
A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to...
JLSEC-2026-848
A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char and math division by zero. This would...
JLSEC-2026-834
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magickpngwriterawprofile and LocaleNCompare...
JLSEC-2026-846
In the CropImage and CropImageToTiles routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefined behavior in the form of integer overflow and out-of-range values as reported by UndefinedBehaviorSanitizer. Such issues could cause a...
JLSEC-2026-862
In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator where a sizet cast should have been a ssizet cast, which causes out-of-range values under some circumstances when a crafted input file is processed by ImageMagick. Red Hat Product Security marked this as Low severity...
JLSEC-2026-917 ImageMagick has a Memory Leak in magick stream
Summary In ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Details - Vulnerability Type: Memory leak - Affected Version: ImageMagick 7.1.1-47 as of commit 82572afc, June 2025 Reproduction Tested Environment -...
JLSEC-2026-858
In GammaImage of /MagickCore/enhance.c, depending on the gamma value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. The patch uses the PerceptibleReciprocal to prevent the...