11844 matches found
ECHO-9B94-4C06-2947
Bulletin has no description...
ECHO-31EA-20FC-ADE1
Bulletin has no description...
ECHO-40B2-F523-98E1
Bulletin has no description...
ECHO-6BBB-610C-309A
Bulletin has no description...
ECHO-91D8-ECDE-0F9D
Bulletin has no description...
ECHO-8428-9583-4BB5
Bulletin has no description...
ECHO-A2AA-110F-94F8
Bulletin has no description...
ECHO-CC54-AFD5-C35F
Bulletin has no description...
ECHO-E186-1AAB-8C05
Bulletin has no description...
ECHO-385B-9C72-908B
Bulletin has no description...
ECHO-76F9-203F-42FD
Bulletin has no description...
ECHO-7BA5-1829-1400
Bulletin has no description...
ECHO-C7AB-A86E-DBB9
Bulletin has no description...
ECHO-5B49-D442-775C
Bulletin has no description...
ECHO-BBDD-CC38-C3A7
Bulletin has no description...
ECHO-A26A-B5FE-3AB2
Bulletin has no description...
ECHO-C899-4F89-0881
Bulletin has no description...
ECHO-9D3D-C34F-5DFC
Bulletin has no description...
ECHO-9E51-27FB-FFEC
Bulletin has no description...
ECHO-76FB-F78F-1FBE
Bulletin has no description...
ECHO-23EA-4A77-0EFC
Bulletin has no description...
ECHO-DD0B-5DB3-5ACE Information disclosure via decoded pixel data from heap memory. Vulnerability introduced in 3.4.0; the affected code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-4DD0-0410-16F9 Misaligned memory write in LossyDctDecoder_execute() HALF->FLOAT expansion in the OpenEXRCore DWA decoder. Vulnerability introduced in 3.2.0; the affected core DWA decoder does not exist in 3.1.x.
Bulletin has no description...
ECHO-DB67-6198-EA48 Heap write overflow in HTJ2K decoder. HTJ2K compression support was added in 3.4.0; the codec does not exist in 3.1.x.
Bulletin has no description...
ECHO-90ED-3DB2-7E6C
Bulletin has no description...
ECHO-CA8B-4D06-0A38
Bulletin has no description...
ECHO-BEF0-7838-A483 Integer overflow in internal_dwa_compressor.h:1722. Vulnerability introduced in 3.2.0; the affected code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-9812-7C70-A870 DWA lossy decoder signed 32-bit overflow in rowBlock pointer construction. Vulnerability introduced in 3.2.0; the affected DWA core decoder code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-4D14-5E51-2C9B
Bulletin has no description...
ECHO-BA7D-8327-9F35
Bulletin has no description...
ECHO-76A8-CCA4-145A
Bulletin has no description...
ECHO-FD63-872C-58AA Out-of-bounds write in B44/B44A via exr_decoding_run(). The vulnerable code path through the new C core decoding API was introduced in 3.4.0 and does not exist in 3.1.x.
Bulletin has no description...
ECHO-D981-9908-5125
Bulletin has no description...
ECHO-1364-3D73-650F
Bulletin has no description...
ECHO-DD6A-E30B-958D
Bulletin has no description...
ECHO-2662-3E6C-1C7B
Bulletin has no description...
ECHO-3812-47CC-7FC2 Signed integer overflow in undo_pxr24_impl() in the OpenEXRCore PXR24 decoder. Vulnerability introduced in 3.2.0; the affected core PXR24 decoder does not exist in 3.1.x.
Bulletin has no description...
ECHO-93C5-5788-8DA1 Integer overflow in internal_dwa_compressor.h:1040. Vulnerability introduced in 3.2.0; the affected code path does not exist in 3.1.x.
Bulletin has no description...
ECHO-473C-40B9-E821
Bulletin has no description...
ECHO-8F94-ADFC-30E7
Bulletin has no description...
ECHO-F43E-2C25-B994 Excessive memory allocation via unvalidated dataWindow size values. The vulnerability is specific to 3.3.x+ code paths. In 3.1.13, the equivalent code uses uiMult() which has built-in overflow checking, and the chunkTableValid() API used in the fix does not exist.
Bulletin has no description...
ECHO-0B54-ECED-403B Excessive memory allocation in Header::readfrom via ImageMagick. Disputed by maintainer and multiple third parties as not a valid vulnerability - the issue is in the use of openexr via ImageMagick, with no real security impact in openexr itself.
Bulletin has no description...
ECHO-5FC2-C517-FF68
Bulletin has no description...
ECHO-F635-511D-B439
Bulletin has no description...
ECHO-F0A7-0B20-68FA
Bulletin has no description...
ECHO-0199-0689-E425
Bulletin has no description...
ECHO-B5C0-4020-9633
Bulletin has no description...
ECHO-B0AE-FACC-5AE1 The CVE text claims arbitrary code execution "via creating a crafted AAC file" in libx264. libx264 is an H.264 encoder and never parses AAC or any other container or audio input. The only reference, x264 issue #75, is a LeakSanitizer report from running FFmpeg's configure checks with --enable-libx264: when x264_encoder_open() fails, its fail: path frees the encoder without x264_param_cleanup(), so the copied parameter strings (a few hundred bytes) leak once. There is no out-of-bounds access, no use-after-free and no attacker-controlled data involved. FFmpeg closed the original ticket as invalid and pointed at the leak in libx264. The record was assigned by MITRE with no CNA score; the 9.8 comes from CISA-ADP. Debian rates it unimportant in every suite ("Negligible security impact, usually only used for short-lived processes"), and no x264 commit since the report touches this path, so there is nothing to backport.
Bulletin has no description...