JLSEC-2025-16 An issue was discovered in cairo 1.16.0

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function arcerrornormalized in the file cairo-arc.c, related to arcmaxanglefortolerancenormalized...

JLSEC-2025-12 cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of...

cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service out-of-bounds read because of mishandling of an unexpected malloc0 call...

JLSEC-2025-15 An issue was discovered in cairo 1.16.0

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c...

JLSEC-2025-14 cairo 1.16.0, in `cairo_ft_apply_variations()` in cairo-ft-font.c, would free memory using a free...

cairo 1.16.0, in cairoftapplyvariations in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free: invalid pointer" error...

JLSEC-2025-17 A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4

A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untruste...

JLSEC-2025-13 cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted...

cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c the generate and renderrows functions and cairo-image-compositor.c the cairoimagespansandzero function...

JLSEC-2025-11 `BZ2_decompress` in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are...

BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors...

JLSEC-2025-10 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a...

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service crash via a crafted bzip2 file, related to block ends set to before the start of the block...

JLSEC-2025-9 ImageMagick is free and open-source software used for editing and manipulating digital images

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

JLSEC-2025-7 ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain...

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. A configuration...

JLSEC-2025-8 ssh in OpenSSH before 10.1 allows the '`\0`' character in an `ssh://` URI, potentially leading to code...

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used...

JLSEC-2025-3 Lack of validation for user-provided fields in GitForge.jl

Description There is a lack of input validation for user-provided values in certain functions. In the GitForge.getrepo function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encoded and are sent directly to the server. Impact...

JLSEC-2025-1 CR/LF injection in URIs.jl (also affects HTTP.jl)

Description The URIs.jl and HTTP.jl packages allowed the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, this can lead to a CRLF injection attack. With this simple Julia code, you can inject a custom header named Foo with the value bar: juli...

JLSEC-2025-2 Command injection in `withpasswd()` function in Registrator.jl

Impact If the clone URL returned by GitHub is malicious or can be injected using upstream vulnerabilities, a shell script injection can occur within the withpasswd function. This can then lead to a potential RCE. Patches Users should upgrade immediately to v1.9.5. All prior versions are vulnerabl...

JLSEC-2025-5 Lack of validation for user-provided fields in GitHub.jl

There is a lack of input validation for user-provided values in certain functions. In the GitHub.repo function, the user can provide any string for the reponame field. These inputs are not validated or safely encoded and are sent directly to the server. Impact This means a user can add path...

JLSEC-2025-4 Argument injection in `gettreesha()` function in Registrator.jl

Impact If the clone URL returned by GitHub is malicious or can be injected using upstream vulnerabilities, an argument injection is possible in the gettreesha function. This can then lead to a potential RCE. Patches Users should upgrade immediately to v1.9.5. All prior versions are vulnerable...

JLSEC-2025-6 An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack...

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose...