195 matches found
CVE-2021-40690
The CVE-2021-40690 issue affects Apache Santuario – XML Security for Java. All versions prior to 2.2.3 and 2.1.7 are vulnerable due to the "secureValidation" property not being passed when creating a KeyInfo from a KeyInfoReference element, enabling an XPath Transform abuse to extract local .xml ...
CVE-2019-16168
CVE-2019-16168 affects SQLite up to version 3.29.0, whereLoopAddBtreeIndex in sqlite3.c may crash a browser/application due to missing validation of sqlite_stat1 sz, described as a severe division by zero in the query planner. Connected documents show multiple advisories referencing the fix in SQ...
CVE-2020-15358
CVE-2020-15358 (SQLite) affects the SQLite library, specifically the query engine path in select.c where the query-flattener optimization mishandles constant propagation for multiSelectOrderBy. The root cause is a mishandling of transitive properties during constant propagation, leading to a heap...
CVE-2018-20843
The CVE-2018-20843 issue affects libexpat (Expat) prior to 2.2.7, where XML inputs with many colons can cause high RAM/CPU usage and enable DoS. Related CVE-2019-15903 describes a heap-based buffer over-read when crafted XML triggers early parsing state switches. Public advisories confirm that an...
CVE-2020-11655
SQLite through 3.31.1 is vulnerable to denial of service via a malformed window-function query caused by improper AggInfo initialization (CVE-2020-11655). Affected is the sqlite3 library used across distributions and apps; exploitation leads to segmentation faults. Remediation in the connected ad...
CVE-2020-13434
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c (CVE-2020-13434). Affected versions are up to 3.32.0; remediation is to update to SQLite 3.32.3. This fix is reflected in multiple advisories (e.g., Apple iOS/macOS security content HT211850/HT211935 noting SQLite u...
CVE-2020-11656
CVE-2020-11656 affects SQLite up to version 3.31.1, where the ALTER TABLE implementation has a use-after-free, demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. Affected products/contexts in the linked documents consistently reference SQLite 3.31.1 or earlier. Some s...
CVE-2020-6851
OpenJPEG vulnerability CVE-2020-6851 affects OpenJPEG 2.3.1 and older, with a heap-based buffer overflow in opj_t1_clbl_decode_processor (openjp2/t1.c) due to missing validation of opj_j2k_update_image_dimensions. Affected versions before 2.4.0 are at risk of arbitrary code execution or crash; ex...
CVE-2020-13630
CVE-2020-13630 affects SQLite prior to 3.32.0, with a use-after-free in ext/fts3/fts3.c (fts3EvalNextRow) related to the snippet feature. Multiple connected advisories (Astra Linux, BSA, AlmaLinux) confirm the issue in SQLite and reference the same function/file. The provided sources do not quant...
CVE-2020-13631
CVE-2020-13631 affects SQLite up to version 3.32.0, where a vulnerability allows renaming a virtual table to the name of one of its shadow tables (related to alter.c and build.c). Connected advisories confirm the issue in SQLite prior to 3.32.0 and note the remediation is to upgrade SQLite to 3.3...
CVE-2020-9327
The CVE-2020-9327 entry concerns SQLite 3.31.1. A NULL pointer dereference can be triggered by isAuxiliaryVtabOperator due to generated column optimizations, potentially causing a segmentation fault. The connected Astra Linux security bulletin confirms the same SQLite 3.31.1 issue but provides no...
CVE-2019-12973
Context: CVE-2019-12973 affects OpenJPEG 2.3.1. Vulnerability: In opj_t1_encode_cblks (openjp2/t1.c), excessive iteration can be exploited by a crafted BMP file to cause a denial of service. This is consistent with related issues in OpenJPEG’s t1.c handling. Impact (as stated): Remote denial of s...
CVE-2020-27844
OpenJPEG vulnerability CVE-2020-27844 affects OpenJPEG before 2.4.0. A crafted input during conversion/encoding can cause an out-of-bounds write in lib/openjp2/t2.c (opj_t2_encode_packet), impacting confidentiality, integrity, and availability. Remediation: upgrade to OpenJPEG 2.4.0 or newer. Exp...
CVE-2020-13632
SQLite vuln CVE-2020-13632 affects ext/fts3/fts3_snippet.c in SQLite
CVE-2020-15389
OpenJPEG up to 2.3.1 is affected by CVE-2020-15389: a use-after-free (and possible double-free) in jp2/opj_decompress.c when a directory contains a mix of valid and invalid files processed by the decompressor. The issue can crash the application or enable memory corruption; it is fixed in OpenJPE...
CVE-2020-27842
CVE-2020-27842 affects the OpenJPEG2 library, specifically the t2 encoder. A crafted input to OpenJPEG prior to version 2.4.0 can trigger a null pointer dereference, with the highest impact being a denial of service through reduced availability. Connected advisories confirm OpenJPEG vulnerabiliti...
CVE-2011-4516
CVE-2011-4516 affects JasPer, specifically the heap-based buffer overflow in the function jpc_cox_getcompparms (libjasper/jpc/jpc_cs.c) within JasPer 1.900.1. A crafted value in a COD (coding style default) marker segment of a JPEG2000 file can cause remote code execution or memory corruption, po...
CVE-2020-27843
CVE-2020-27843 affects OpenJPEG versions before 2.4.0. A specially crafted input to the conversion or encoding path can trigger an out-of-bounds read, with the highest impact on system availability. The connected advisories consistently cite OpenJPEG2 as the vulnerable component and indicate reme...
CVE-2021-31811
CVE-2021-31811: Apache PDFBox 2.0.23 and earlier is vulnerable to an OutOfMemoryError when loading a crafted PDF. IBM/QRadar advisories confirm the issue and recommend upgrading PDFBox to v2.0.24 (via PJ46568 iFix/FIXPACK) or newer.
CVE-2021-27807
CVE-2021-27807 affects Apache PDFBox 2.0.22 and earlier 2.0.x. The issue arises when loading a crafted PDF, triggering an infinite loop and causing denial of service. Connected IBM advisories confirm the same description and map remediation to upgrading to fixed PDFBox versions via product-specif...
CVE-2021-27906
CVE-2021-27906 affects Apache PDFBox; a crafted PDF can trigger an OutOfMemoryError when loading, impacting PDFBox 2.0.22 and earlier 2.0.x. The connected IBM/QRadar security bulletin confirms the same CVE ID and notes remediation: upgrade to IBM Cognos-related 2.0.6.12, then apply FixPack 2.0.6....
CVE-2020-27845
CVE-2020-27845 : In OpenJPEG, the flaw in src/lib/openjp2/pi.c (pre-2.4.0) allows an attacker-provided, untrusted input to trigger an out-of-bounds read during conversion/encoding, with impact to availability. Affected: OpenJPEG versions before 2.4.0. Remediation: upgrade to 2.4.0 or newer (per m...
CVE-2021-20227
CVE-2021-20227 : SQLite contains a flaw in the SELECT implementation (src/select.c) that can trigger a use-after-free when an attacker can run SQL locally. This may lead to a denial of service and, in some cases, possible code execution. The Astra Linux security bulletin mirrors this SQLite issue...
CVE-2016-9583
CVE-2016-9583 affects the JasPer JPEG-2000 library. The vulnerability is an out-of-bounds heap read in the jpc_pi_nextpcrl() function when processing crafted input, and affects Jasper versions prior to 2.0.6. Potential impact is application crash due to invalid memory access. Remediation: upgrade...
CVE-2011-4517
CVE-2011-4517 affects JasPer 1.900.1 used for JPEG-2000 decoding. The flaw is in libjasper/jpc/jpc_cs.c: jpc_crg_getparms uses an incorrect data type during a size calculation, enabling remote attackers to trigger a heap-based buffer overflow via a crafted CRG marker segment in a JPEG2000 file. C...
CVE-2020-27841
CVE-2020-27841 affects the OpenJPEG2 library (openjpeg2) prior to version 2.4.0. The flaw occurs when an attacker provides crafted input to be processed by the OpenJPEG encoder, potentially causing an out-of-bounds read and impacting availability. The issue is evidenced in multiple connected advi...
CVE-2016-10328
CVE-2016-10328 is a heap-based buffer overflow in FreeType 2 caused by an out-of-bounds write in the cff_parser_run function (cff/cffparse.c). Several connected advisories confirm the vulnerability affects FreeType 2 before the 2016-12-16 milestone and note potential remote code execution. Public...
CVE-2018-20584
CVE-2018-20584 affects JasPer 2.0.14 and can cause a remote denial of service (application hang) when converting to JP2. Connected sources indicate IBM Rational Synergy products are affected (7.2.1.x series) and provide a remediation path: upgrade to Rational Synergy 7.2.2 to gain Jetty 9.4.14 su...
CVE-2019-2855
CVE-2019-2855 affects the Oracle Outside In Technology component (Outside In Filters) used by Oracle Fusion Middleware, with the Rational DOORS Next Generation 6.0.6.1 product line explicitly listed as affected. The Red Hat IBM bulletin confirms the vulnerability details and specifies remediation...
CVE-2019-2764
CVE-2019-2764 affects the Oracle Outside In Technology component (subcomponent Outside In Filters) used by Oracle Fusion Middleware, with confirmed impact on Rational DOORS Next Generation 6.0.6.1 where the vulnerability could allow an unauthenticated attacker with network access over HTTP to rea...
CVE-2019-2854
CVE-2019-2854 affects IBM Rational DOORS Next Generation 6.0.6.1 (Outside In Filters in Oracle Outside In Technology). The IBM advisory explicitly lists the vulnerable component and provides a fix path: upgrade to Rational DOORS Next Generation 6.0.6.1 iFix004 or later (and for prior versions, up...
CVE-2015-6013
Summary of findings (CVE-2015-6013 and related Outside In vulnerabilities) : The connected IBM and Tenable entries describe concrete issues in the Oracle Outside In Technology (OIT) Filters component, affecting multiple products as listed in the sources. The vulnerabilities involve stack-based bu...
CVE-2019-2835
CVE-2019-2835 is confirmed in connected sources as affecting Oracle Outside In Technology (Outside In Filters) used by IBM Rational DOORS Next Generation. Affected product/version: Rational DOORS Next Generation 6.0.6.1. Remediation: upgrade to Rational DOORS Next Generation 6.0.6.1 iFix004 or la...
CVE-2017-3293
CVE-2017-3293 is a Use-After-Free vulnerability in the Oracle Outside In Technology (Outside In Filters) used by Oracle Fusion Middleware. Affected versions include 8.5.2 and 8.5.3. The issue arises in the RTF/Outside In Filters parsing path where freed memory can be reused (notably during handli...
CVE-2021-2453
CVE-2021-2453 affects Oracle Outside In Technology (Outside In Filters) as part of Oracle Fusion Middleware. Affected product/version: Outside In Filters in Oracle Outside In Technology, version 8.5.5. The vulnerability allows an unauthenticated, network-accessible attacker (via HTTP) to cause a ...
CVE-2021-2452
The CVE-2021-2452 issue affects Oracle Outside In Technology (Outside In Filters) in Oracle Fusion Middleware, with affected version 8.5.5. The vulnerability enables an unauthenticated attacker with network access via HTTP to cause the target to hang or crash (complete DoS). The Outside In Techno...
CVE-2018-2801
CVE-2018-2801 affects the Oracle Outside In Technology component (Outside In Image Export SDK) used by Oracle Fusion Middleware, specifically version 8.5.3. The vulnerability is exploitable over a network with unauthenticated access and requires human interaction, potentially leading to unauthori...
CVE-2016-3582
Technical details about CVE-2016-3582 are not publicly available in the provided connected documents; monitor for updates.
CVE-2019-2462
CVE-2019-2462 affects Oracle Outside In Technology (Outside In Filters) used in IBM Rational DOORS Next Generation. The IBM advisory confirms a vulnerability in Rational DOORS Next Generation 6.0.6 with Outside In technology that could allow an unauthenticated attacker, over HTTP, to read data fr...
CVE-2021-2240
CVE-2021-2240 affects Oracle Outside In Technology (Outside In Filters) within Oracle Fusion Middleware. Affected: Outside In Filters in Oracle Outside In Technology, version 8.5.5. Vector: network (HTTP) with no authentication. Impact: unauthorized update/insert/delete and read access to Oracle ...
CVE-2017-3270
CVE-2017-3270 is an Outside In Technologies vulnerability (Outside In Filters) affecting Oracle Fusion Middleware 8.5.2/8.5.3. The IBM FileNet/Content Foundation advisories note exposure via HTTP with potential hang/crash (DOS) of Oracle Outside In Technology and related Outside In Filters flaws....
CVE-2021-2450
CVE-2021-2450 pertains to Oracle Outside In Technology (Outside In Filters) used by Oracle Fusion Middleware. Affected: Outside In Technology component in version 8.5.5. Description across multiple feeds confirms unauthenticated network access over HTTP can lead to a hang or crash of Oracle Outsi...
CVE-2024-21119
CVE-2024-21119 affects Oracle Outside In Technology (Outside In Core) within Oracle Fusion Middleware. Affected: Oracle Outside In Technology versions 8.5.6–8.5.7. Local authenticated attackers can gain update/insert/delete permissions and read access to data, with potential partial denial of ser...
CVE-2016-3592
Technical details for CVE-2016-3592 are not publicly available in the provided connected documents; no affected products, root cause, impact, or remediation are specified here. Monitor for updates from official advisories.
CVE-2017-3266
CVE-2017-3266 is a vulnerability in the Oracle Outside In Technology (Outside In Filters) used by Oracle Fusion Middleware. The issue affects affected 8.5.x releases and is described as a use-after-free in the Outside In Filters subcomponent when processing VSDX files, allowing an unauthenticated...
CVE-2021-2449
CVE-2021-2449 pertains to Oracle Outside In Technology (Fusion Middleware), specifically the Outside In Filters component. Affected is version 8.5.5 . The vulnerability allows an unauthenticated attacker with network access via HTTP to cause a hang or a “complete DoS” in Oracle Outside In Technol...
CVE-2016-3594
Technical details about CVE-2016-3594 are not publicly provided in the supplied connected documents. Monitor for updates; no specific affected products, root cause, impact, or remediation are laid out here.
CVE-2016-3596
Technical details about CVE-2016-3596 are not publicly available in the provided connected documents. Monitor for updates.
CVE-2015-6014
CVE-2015-6014 is described as a stack-based buffer overflow in Oracle Outside In Technology’s Filters component when handling DOC files, potentially enabling a local or remote attacker to cause a denial of service or execute arbitrary code. Connected IBM advisories (Content Collector for Email) e...