11430 matches found
ECHO-BBDD-CC38-C3A7
Bulletin has no description...
ECHO-5B49-D442-775C
Bulletin has no description...
ECHO-76FB-F78F-1FBE
Bulletin has no description...
ECHO-C899-4F89-0881
Bulletin has no description...
ECHO-9D3D-C34F-5DFC
Bulletin has no description...
ECHO-9E51-27FB-FFEC
Bulletin has no description...
ECHO-23EA-4A77-0EFC
Bulletin has no description...
ECHO-F43E-2C25-B994 Excessive memory allocation via unvalidated dataWindow size values. The vulnerability is specific to 3.3.x+ code paths. In 3.1.13, the equivalent code uses uiMult() which has built-in overflow checking, and the chunkTableValid() API used in the fix does not exist.
Bulletin has no description...
ECHO-DB67-6198-EA48 Heap write overflow in HTJ2K decoder. HTJ2K compression support was added in 3.4.0; the codec does not exist in 3.1.x.
Bulletin has no description...
ECHO-DD0B-5DB3-5ACE Information disclosure via decoded pixel data from heap memory. Vulnerability introduced in 3.4.0; the affected code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-8F94-ADFC-30E7
Bulletin has no description...
ECHO-90ED-3DB2-7E6C
Bulletin has no description...
ECHO-3812-47CC-7FC2 Signed integer overflow in undo_pxr24_impl() in the OpenEXRCore PXR24 decoder. Vulnerability introduced in 3.2.0; the affected core PXR24 decoder does not exist in 3.1.x.
Bulletin has no description...
ECHO-76A8-CCA4-145A
Bulletin has no description...
ECHO-CA8B-4D06-0A38
Bulletin has no description...
ECHO-473C-40B9-E821
Bulletin has no description...
ECHO-4D14-5E51-2C9B
Bulletin has no description...
ECHO-93C5-5788-8DA1 Integer overflow in internal_dwa_compressor.h:1040. Vulnerability introduced in 3.2.0; the affected code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-BA7D-8327-9F35
Bulletin has no description...
ECHO-9812-7C70-A870 DWA lossy decoder signed 32-bit overflow in rowBlock pointer construction. Vulnerability introduced in 3.2.0; the affected DWA core decoder code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-D981-9908-5125
Bulletin has no description...
ECHO-1364-3D73-650F
Bulletin has no description...
ECHO-4DD0-0410-16F9 Misaligned memory write in LossyDctDecoder_execute() HALF->FLOAT expansion in the OpenEXRCore DWA decoder. Vulnerability introduced in 3.2.0; the affected core DWA decoder does not exist in 3.1.x.
Bulletin has no description...
ECHO-DD6A-E30B-958D
Bulletin has no description...
ECHO-0B54-ECED-403B Excessive memory allocation in Header::readfrom via ImageMagick. Disputed by maintainer and multiple third parties as not a valid vulnerability - the issue is in the use of openexr via ImageMagick, with no real security impact in openexr itself.
Bulletin has no description...
ECHO-2662-3E6C-1C7B
Bulletin has no description...
ECHO-FD63-872C-58AA Out-of-bounds write in B44/B44A via exr_decoding_run(). The vulnerable code path through the new C core decoding API was introduced in 3.4.0 and does not exist in 3.1.x.
Bulletin has no description...
ECHO-BEF0-7838-A483 Integer overflow in internal_dwa_compressor.h:1722. Vulnerability introduced in 3.2.0; the affected code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-5FC2-C517-FF68
Bulletin has no description...
ECHO-F635-511D-B439
Bulletin has no description...
ECHO-F0A7-0B20-68FA
Bulletin has no description...
ECHO-0199-0689-E425
Bulletin has no description...
ECHO-B5C0-4020-9633
Bulletin has no description...
ECHO-B0AE-FACC-5AE1 The CVE text claims arbitrary code execution "via creating a crafted AAC file" in libx264. libx264 is an H.264 encoder and never parses AAC or any other container or audio input. The only reference, x264 issue #75, is a LeakSanitizer report from running FFmpeg's configure checks with --enable-libx264: when x264_encoder_open() fails, its fail: path frees the encoder without x264_param_cleanup(), so the copied parameter strings (a few hundred bytes) leak once. There is no out-of-bounds access, no use-after-free and no attacker-controlled data involved. FFmpeg closed the original ticket as invalid and pointed at the leak in libx264. The record was assigned by MITRE with no CNA score; the 9.8 comes from CISA-ADP. Debian rates it unimportant in every suite ("Negligible security impact, usually only used for short-lived processes"), and no x264 commit since the report touches this path, so there is nothing to backport.
Bulletin has no description...
ECHO-F55E-6DD0-D4B5
Bulletin has no description...
ECHO-0BD2-8B5E-2B5A SoupCache ignores the HTTP Vary header when reusing cached responses. The vulnerable path is only reachable when a client explicitly enables the optional on-disk SoupCache feature (soup_session_add_feature with SoupCache) AND acts as a shared/multi-user HTTP proxy — neither applies to Echo's use of libsoup3 as a client library. No upstream fix exists (a TODO in soup_cache_has_response(); issue #453 was closed as a duplicate of the still-open upstream issue #112). Debian rates it no-dsa, Minor. https://security-tracker.debian.org/tracker/CVE-2025-9901
Bulletin has no description...
ECHO-0D17-9796-549F
Bulletin has no description...
ECHO-692B-622B-7965
Bulletin has no description...
ECHO-C993-31DB-A8BF
Bulletin has no description...
ECHO-74B5-8029-1A64
Bulletin has no description...
ECHO-4EBF-BC2C-395E
Bulletin has no description...
ECHO-CEAB-F4E8-A26D
Bulletin has no description...
ECHO-C0AC-D14A-83AB
Bulletin has no description...
ECHO-1AE6-5677-99CD
Bulletin has no description...
ECHO-60B1-7D52-5AA4
Bulletin has no description...
ECHO-13F8-D7EC-BFEF
Bulletin has no description...
ECHO-47E4-5B68-7DD8
Bulletin has no description...
ECHO-14E3-A93D-99BA
Bulletin has no description...