11934 matches found
ECHO-7DE2-C990-7BC9
Bulletin has no description...
ECHO-272E-9F96-27F5
Bulletin has no description...
ECHO-A4DF-8BA1-1B3B
Bulletin has no description...
ECHO-480E-F2AF-BD01
Bulletin has no description...
ECHO-FF10-C876-4FAA Out-of-bounds read in core image-sequence parsing: a malformed HEIF sequence with stco.entry_count == 0 and saiz.sample_count > 0 drives SampleAuxInfoReader to dereference an empty chunks[0]. This sequence / ISOBMFF track parsing (SampleAuxInfoReader, Box_saiz/saio/stco, TrackBox/MovieBox) was added in v1.20.0. v1.19.8 — the version we ship — has no track parsing at all, so the vulnerable code is not present (verified: none of those symbols exist in the v1.19.8 source).
Bulletin has no description...
ECHO-0BD8-3C77-95C2 Vulnerability is in libheif's image-sequence / ISOBMFF track parsing, which was added in v1.20.0. v1.19.8 — the version we ship — has no track parsing at all (no Box_stsc / Box_stts / Box_saiz / TrackBox / MovieBox), so the vulnerable code is not present.
Bulletin has no description...
ECHO-9CF0-966B-4F31
Bulletin has no description...
ECHO-966C-4616-ACC0 CPU-consumption DoS in gdImageArc/gdImageFilledArc (libgd before 2.0.35) via a very large start/end angle, which drove the unbounded arc loop. The libgd 2.0.35 fix — normalizing the angles and clamping the sweep to <= 360 before the drawing loop — is already present in this trixie source: gdImageFilledArc in src/extra/gd/gd.c reduces s/e modulo 360 and rewinds e to s (the block preceding "for (i = s; (i <= e); i++)"), so the loop runs at most ~720 iterations regardless of the requested angle. There is nothing to backport; the vulnerability does not reproduce against 0.2.13. Debian rates trixie "unimportant".
Bulletin has no description...
ECHO-0435-D140-FC4A Buffer overflow/over-read in _gdGetColors (gd_gd.c) reached via the GD-file reader (gdImageCreateFromGd) when colorsTotal is not validated (libgd 2.x / PHP before 5.3.1). libwmf uses its bundled GD only as an output backend and exposes no API that decodes an untrusted .gd file, so the vulnerable reader path is never invoked. Additionally the upstream validation is already present in this trixie source: _gdGetColors in src/extra/gd/gd_gd.c rejects colorsTotal > gdMaxColors, and the non-2x branch reads colorsTotal as a single byte (<= 255 < gdMaxColors). Not reachable and already remediated in source; scanners flag it only via Debian's stale source-package match (trixie "unimportant / unfixed"; standalone libgd2 is fixed).
Bulletin has no description...
ECHO-07BD-5728-1AD8 Assertion failure (abort/DoS) in jxl::PlaneBase::PlaneBase() reachable only when the cjxl encoder is used to encode a maliciously crafted GIF. There is no memory corruption and no upstream fix: the upstream tracking issues (#422, #762) remain open with no merged commit, and Debian rates the issue "unimportant" with a "Negligible security impact" note and no fixed version in any suite (bookworm through sid). With no upstream remediation available and negligible impact on the libjxl decode path we ship, this is not actionable as a backport.
Bulletin has no description...
ECHO-5523-AAD4-D06D
Bulletin has no description...
ECHO-DFB6-9966-93AB
Bulletin has no description...
ECHO-A7ED-BFEC-5FE3 Array index error in gd_gif_in.c in the bundled GD graphics library (libgd before 2.0.35), reached via the GIF reader (gdImageCreateFromGif). libwmf carries its own copy of GD under src/extra/gd and compiles it (Debian does not build-depend on libgd-dev, so LIBWMF_OPT_SYS_GD is off), but that copy ships no GIF reader at all: there is no gd_gif_in.c/gd_gif_out.c and libgd_la_SOURCES in src/extra/gd/Makefile.am compiles no GIF source. libwmf uses GD only as a rasterization/output backend and never decodes GIF input. The vulnerable code is not present or reachable in this package; scanners flag it only via Debian's stale source-package match (trixie is "unimportant / unfixed" while standalone libgd2 is fixed).
Bulletin has no description...
ECHO-47DE-5D2A-48D4 Integer overflows in libgd (before 2.0.35) in gdImageCreate, gdImageCreateTrueColor and gdImageCopyResized on large width/height, overflowing the pixel-buffer allocation. The libgd 2.0.35 fix — the overflow2() helper and its guards on the sx*sy allocations — is already present in this trixie source: overflow2() is defined in src/extra/gd/gdhelpers.c and gdImageCreate / gdImageCreateTrueColor in src/extra/gd/gd.c bail out via overflow2(sx, sy) and the per-row size checks before allocating. There is nothing to backport; the vulnerability does not reproduce against 0.2.13. Debian rates trixie "unimportant".
Bulletin has no description...
ECHO-E912-6020-E80C Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-80BC-857B-65B0 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-85A3-417A-5FA2 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-9793-C0AF-3276 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-8D60-A235-3FD6 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-7220-A71F-2BCE Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-44BA-D76C-2090 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-E5E9-738B-90E8
Bulletin has no description...
ECHO-3D1A-D16A-7322
Bulletin has no description...
ECHO-A791-A6E2-27DF
Bulletin has no description...
ECHO-5C07-3B17-DA79
Bulletin has no description...
ECHO-AA57-A866-13B0
Bulletin has no description...
ECHO-5273-C4A4-86BD
Bulletin has no description...
ECHO-29D0-3CD0-6188
Bulletin has no description...
ECHO-53BC-50E8-6EFB
Bulletin has no description...
ECHO-D537-58D2-7E5E
Bulletin has no description...
ECHO-296A-CB3F-7FE4
Bulletin has no description...
ECHO-A4D2-499C-9C7A
Bulletin has no description...
ECHO-6D88-73D8-CF02
Bulletin has no description...
ECHO-7329-DCEB-1B90
Bulletin has no description...
ECHO-BA02-B526-DCE0
Bulletin has no description...
ECHO-2A36-45FA-CE19
Bulletin has no description...
ECHO-0D78-6C28-581D
Bulletin has no description...
ECHO-2DA3-FD4F-7F6D
Bulletin has no description...
ECHO-13D2-5278-FD42
Bulletin has no description...
ECHO-78F9-A556-CD85
Bulletin has no description...
ECHO-C0B7-4974-5ED1
Bulletin has no description...
ECHO-E7AA-EE79-EAD7
Bulletin has no description...
ECHO-DF15-FB2A-FC10
Bulletin has no description...
ECHO-5AD8-0DA9-194D
Bulletin has no description...
ECHO-9183-BA03-ED56
Bulletin has no description...
ECHO-AFDF-CD6B-D2FD
Bulletin has no description...
ECHO-17E4-ED52-C350
Bulletin has no description...
ECHO-22EE-1F86-CE2C
Bulletin has no description...