From fe55920c9b7953c2d574b521b5e3cf9d3c0893ef Mon Sep 17 00:00:00 2001 From: Chadd Owen Date: Tue, 25 Aug 2026 13:01:24 -0600 Subject: [PATCH 1/2] vulnerability data description exports for v5 and v6 apps Signed-off-by: Chadd Owen --- utilities/vulndata/README.md | 118 ++- utilities/vulndata/vulndata | 1387 ++++++++++++++++++++++++++- utilities/vulndata/vulndata.sh | 16 +- utilities/vulndata/vulndata_apps.py | 207 ++++ 4 files changed, 1701 insertions(+), 27 deletions(-) create mode 100755 utilities/vulndata/vulndata_apps.py diff --git a/utilities/vulndata/README.md b/utilities/vulndata/README.md index 3eed9c7..c88ab32 100644 --- a/utilities/vulndata/README.md +++ b/utilities/vulndata/README.md @@ -1,5 +1,117 @@ -# Bash +# vulndata -This is where you can find bash scripts related to the Anchore Enterprise API. +Both scripts here do the same thing — pull the **full NVD description** for every CVE affecting a given Application Version. The standard Enterprise vulnerability report only returns match metadata (severity, CVSS, etc.) with little or no description text, so these dig out the fuller `nvd_data[].description` text that the UI and `anchorectl` don't normally surface. -These scripts call the Anchore Enterprise REST API directly using `curl` and `jq`. Credentials are loaded from an `anchore.env` file and should never be hardcoded. +Pick the one that matches your Enterprise version — the underlying API changed between 5.x and 6.x. + +| Script | Enterprise version | API used | +|---|---|---| +| [`vulndata.sh`](#vulndatash-enterprise-5x) | 5.x | `/applications` (legacy Application Management) | +| [`vulndata_apps.py`](#vulndata_appspy-enterprise-6x) | 6.x | `/apps` | + +--- + +## `vulndata.sh` (Enterprise 5.x) + +> [!IMPORTANT] +> This targets **Anchore Enterprise 5.x** only. It calls the legacy `/applications` API for [Application Management](https://docs.anchore.com/current/docs/application_management/), which does not exist in the same form in Enterprise 6.x — use `vulndata_apps.py` instead. + +### Prerequisites + +- `curl` and `jq` installed +- An Anchore Enterprise 5.x deployment with API access +- The target Application and Application Version must already exist in Anchore (created via SBOM import) — this script only reads existing data, it does not create or scan anything + +### Configuration + +Credentials come from your environment first, then fall back to an `anchore.env` file — never hardcode them in the script. + +If you already have `anchorectl` configured in your shell (`ANCHORECTL_USERNAME`, `ANCHORECTL_PASSWORD`, `ANCHORECTL_URL`), the script reuses those automatically — no extra setup needed. Otherwise, create an `anchore.env` file next to `vulndata.sh`: + +```bash +# anchore.env +USERNAME=admin +PASSWORD=foobar +ANCHORE_URL=https://anchore.example.com/v2 +``` + +> `ANCHORECTL_URL` typically points at the base API (e.g. `http://anchore.example.com:8228`) without a version suffix. This script hits the `/applications` endpoint directly, so make sure whichever URL is used (env var or `anchore.env`) includes the correct base path (often `/v2`) for your deployment. + +Then edit the two variables near the top of `vulndata.sh` to point at the Application and Version you want a report for: + +```bash +APP_NAME="rust" +TARGET_VERSION="2.0" +``` + +> In a GitLab CI job you can set `APP_NAME` from `$CI_PROJECT_NAME` and `TARGET_VERSION` from a git tag instead of hardcoding them. + +### Usage + +```bash +chmod +x vulndata.sh +./vulndata.sh +``` + +The script will: + +1. Look up the `application_id` and `application_version_id` for `APP_NAME` / `TARGET_VERSION`. +2. Fetch the vulnerability report for that Application Version. +3. Print each CVE ID and its NVD description, and save the same output to a file named `vulndata` in the current directory (overwritten on each run). + +### Notes + +- Exits early with an error if the Application/Version name pair can't be found, or if credentials are missing. +- Only vulnerabilities with an `nvd` entry are included — findings without NVD data (e.g. GHSA-only advisories) won't appear in the output. + +--- + +## `vulndata_apps.py` (Enterprise 6.x) + +> [!IMPORTANT] +> This targets **Anchore Enterprise 6.x**, which replaced `/applications` with the `/apps` API. Use `vulndata.sh` for 5.x deployments. + +Enterprise 6's `/apps/{app_id}/versions/{version_id}/vulnerabilities` endpoint only returns match metadata (severity, CVSS, EPSS, KEV, `anchore_score`) — no description text at all. Getting the description back requires an extra round trip to the standalone vulnerability catalog, which is more than is comfortable to chain together in `bash`/`jq`, so this one's Python. + +### What it does + +1. `GET /apps?name=` → resolves the app ID +2. `GET /apps/{app_id}/versions?name=` → resolves the version ID +3. `GET /apps/{app_id}/versions/{version_id}/vulnerabilities` → collects every matched CVE ID (paginated via cursor) +4. `GET /query/vulnerabilities?id=` → looks up each CVE in batches of 50 and pulls `nvd_data[].description` + +### Prerequisites + +- `python3` (3.8+, standard library only — nothing to `pip install`) +- An Anchore Enterprise 6.x deployment with API access +- The target App and App Version must already exist in Anchore — this script only reads existing data + +### Configuration + +No `anchore.env` file here — being Python, it reads credentials the same way `anchorectl` itself does: + +1. `ANCHORECTL_USERNAME` / `ANCHORECTL_PASSWORD` / `ANCHORECTL_URL` environment variables, if set +2. Otherwise, your `anchorectl` config file (`.anchorectl.yaml`, `~/.anchorectl.yaml`, `$XDG_CONFIG_HOME/anchorectl/config.yaml`, etc. — same search order anchorectl uses), reading its `url` / `username` / `password` keys + +If you already use `anchorectl` against this deployment, there's nothing to configure. + +It also normalizes the base URL itself — it appends `/v2` automatically if the URL doesn't already end in it, so a bare `ANCHORECTL_URL` (e.g. `http://anchore.example.com:8228`) or config `url:` works as-is. + +### Usage + +```bash +chmod +x vulndata_apps.py +./vulndata_apps.py + +# example +./vulndata_apps.py rust 2.0 + +# custom output file (default: vulndata) +./vulndata_apps.py rust 2.0 --output vulndata-rust.txt +``` + +### Notes + +- Exits early with an error if the app/version name pair can't be found, if credentials are missing, or on any non-2xx API response (the error includes the response body). +- If a CVE has multiple `nvd_data` entries, the first with a non-empty `description` is used; if there's no NVD data at all, it falls back to the record's generic `description`, or prints `(no description available)`. +- App and version names are matched exactly (case-sensitive), same as the API's `name` filter. diff --git a/utilities/vulndata/vulndata b/utilities/vulndata/vulndata index 4ee2f28..e681625 100644 --- a/utilities/vulndata/vulndata +++ b/utilities/vulndata/vulndata @@ -1,46 +1,1393 @@ -CVE-2010-4756: The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. +---------------------------------------------------------- +Vulnerability Report for Spectro 1.0.0 +---------------------------------------------------------- +CVE-2026-59873: A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable. -CVE-2019-1010024: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. +CVE-2026-53492: (no description available) -CVE-2007-5686: initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers. +CVE-2026-50195: (no description available) -CVE-2021-45346: A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect. +CVE-2025-7783: A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data. +This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation. -CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." +CVE-2024-38428: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. + +CVE-2024-32002: A vulnerability was found in Git. This vulnerability allows the malicious manipulation of repositories containing submodules, exploiting a bug that enables the writing of files into the .git/ directory instead of the submodule's intended worktree. This manipulation facilitates the execution of arbitrary code during the cloning process, bypassing user inspection and control. + +CVE-2023-45853: (no description available) + +CVE-2023-38408: (no description available) + +CVE-2023-32002: The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. + +CVE-2022-48565: (no description available) + +CVE-2021-3177: (no description available) + +CVE-2026-73566: (no description available) + +CVE-2026-69152: (no description available) + +CVE-2026-59874: (no description available) + +CVE-2026-58043: (no description available) + +CVE-2026-56865: A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy + +CVE-2026-56864: A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy + +CVE-2026-56862: (no description available) + +CVE-2026-56859: (no description available) + +CVE-2026-56853: When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. + +CVE-2026-56848: A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +CVE-2026-56846: A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**. + +CVE-2026-54876: Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. + +CVE-2026-48937: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**. + +CVE-2026-48617: A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. + +CVE-2026-46603: (no description available) + +CVE-2026-46600: (no description available) + +CVE-2026-39821: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". + +CVE-2026-33818: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. + +CVE-2026-31802: node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11. + +CVE-2026-29786: (no description available) + +CVE-2026-27904: (no description available) + +CVE-2026-27903: A flaw was found in minimatch, a utility for converting glob expressions into JavaScript regular expressions. A remote attacker can exploit this vulnerability by providing a specially crafted glob pattern containing multiple non-adjacent `**` (GLOBSTAR) segments. This can lead to unbounded recursive backtracking in the `matchOne()` function, causing a Denial of Service (DoS) by stalling the Node.js event loop for an extended period. + +CVE-2026-26996: A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive. + +CVE-2026-26960: (no description available) + +CVE-2026-24842: (no description available) + +CVE-2026-23950: (no description available) + +CVE-2026-23745: (no description available) + +CVE-2026-21710: (no description available) + +CVE-2026-21637: (no description available) + +CVE-2026-14456: (no description available) + +CVE-2026-14257: (no description available) + +CVE-2026-13149: (no description available) + +CVE-2026-12143: (no description available) + +CVE-2025-59466: A stack overflow flaw has been discovered in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions. + +CVE-2025-59465: CVE-2025-59465 affecting package nodejs for versions less than 20.14.0-11. A patched version of the package is available. + +CVE-2025-55131: (no description available) + +CVE-2025-23166: (no description available) + +CVE-2024-4741: (no description available) + +CVE-2024-4032: (no description available) + +CVE-2024-33655: (no description available) + +CVE-2024-33602: nscd: netgroup cache assumes NSS callback uses in-buffer strings + +The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory +when the NSS callback does not store all strings in the provided buffer. +The flaw was introduced in glibc 2.15 when the cache was added to nscd. + +This vulnerability is only present in the nscd binary. + +CVE-2024-33601: (no description available) + +CVE-2024-33599: CVE-2024-33599 affecting package glibc for versions less than 2.35-7. A patched version of the package is available. + +CVE-2024-32465: (no description available) + +CVE-2024-32021: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning +will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. + +CVE-2024-32004: A vulnerability was found in Git. This vulnerability can be exploited by an unauthenticated attacker who places a specialized repository on the target's local system. If the victim clones this repository, the attacker can execute arbitrary code. + +CVE-2024-2961: (no description available) + +CVE-2024-29415: (no description available) + +CVE-2024-27983: CVE-2024-27983 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue. + +CVE-2024-26461: (no description available) + +CVE-2024-25062: (no description available) + +CVE-2024-2398: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. + +CVE-2024-22019: (no description available) + +CVE-2024-21892: (no description available) + +CVE-2024-21538: Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. + +CVE-2024-0985: (no description available) + +CVE-2024-0553: A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. + +CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5. + +CVE-2023-7104: (no description available) + +CVE-2023-6610: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. + +CVE-2023-6535: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service. + +CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory. + +CVE-2023-52425: libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. + +CVE-2023-52356: CVE-2023-52356 affecting package libtiff for versions less than 4.6.0-2. A patched version of the package is available. + +CVE-2023-52355: (no description available) + +CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. + +CVE-2023-50387: (no description available) + +CVE-2023-49468: Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc. + +CVE-2023-49467: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc. + +CVE-2023-49465: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc. + +CVE-2023-4863: (no description available) + +CVE-2023-46809: (no description available) + +CVE-2023-44487: (no description available) + +CVE-2023-43887: (no description available) + +CVE-2023-43787: A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. + +CVE-2023-39417: CVE-2023-39417 affecting package postgresql for versions less than 14.10-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-39180: (no description available) + +CVE-2023-39179: (no description available) + +CVE-2023-39176: (no description available) + +CVE-2023-38552: (no description available) + +CVE-2023-3640: A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled. However, despite this feature, there is still a risk of per-cpu entry area leaks. This issue could allow a local user to gain access to some important data with memory in an expected location and potentially escalate their privileges on the system. + +CVE-2023-32559: A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') to run arbitrary code outside of the limits defined in a policy.json file. + +CVE-2023-32006: CVE-2023-32006 affecting package nodejs18 for versions less than 18.17.1-2. An upgraded version of the package is available that resolves this issue. + +CVE-2023-31484: (no description available) + +CVE-2023-3138: CVE-2023-3138 affecting package libX11 for versions less than 1.6.12-6. A patched version of the package is available. + +CVE-2023-2953: (no description available) + +CVE-2023-29499: CVE-2023-29499 affecting package glib for versions less than 2.71.0-4. A patched version of the package is available. + +CVE-2023-29491: CVE-2023-29491 affecting package ncurses for versions less than 6.4-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-29007: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. + +CVE-2023-27534: A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. + +CVE-2023-27533: (no description available) + +CVE-2023-27103: Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc. + +CVE-2023-25652: (no description available) + +CVE-2023-25193: (no description available) + +CVE-2023-2454: A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code. + +CVE-2023-24329: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. + +CVE-2023-1999: (no description available) + +CVE-2023-0996: There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call. + +CVE-2023-0464: A security vulnerability has been identified in all supported versions + +of OpenSSL related to the verification of X.509 certificate chains +that include policy constraints. Attackers may be able to exploit this +vulnerability by creating a malicious certificate chain that triggers +exponential use of computational resources, leading to a denial-of-service +(DoS) attack on affected systems. + +Policy processing is disabled by default but can be enabled by passing +the `-policy' argument to the command line utilities or by calling the +`X509_VERIFY_PARAM_set1_policies()' function. + +CVE-2022-48622: (no description available) + +CVE-2022-48560: A use-after-free exists in Python through 3.9 via heappushpop in heapq. + +CVE-2022-48541: A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command. + +CVE-2022-45061: An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. + +CVE-2022-3636: (no description available) + +CVE-2022-3566: (no description available) + +CVE-2022-3534: A use-after-free flaw was found in btf_dump_name_dups in tools/lib/bpf/btf_dump.c in libbpf in the Linux Kernel. This issue occurs because the key stored in the hash table name_map is a string address, and the string memory is allocated by realloc() function. When the memory is resized by realloc() later, the old memory may be freed. + +CVE-2022-32547: (no description available) + +CVE-2022-32546: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. + +CVE-2022-32545: A vulnerability was found in ImageMagick. When crafted or untrusted input is processed, it causes issues outside the range of values of type 'unsigned char' at coders/psd.c. This issue leads to a negative impact on application availability or other problems related to undefined behavior. + +CVE-2022-28463: ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. + +CVE-2022-25883: CVE-2022-25883 affecting package nodejs for versions less than 16.20.1-2. A patched version of the package is available. + +CVE-2022-25881: (no description available) + +CVE-2022-2327: (no description available) + +CVE-2022-2309: (no description available) + +CVE-2022-1304: (no description available) + +CVE-2022-1247: (no description available) + +CVE-2022-0400: An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos. + +CVE-2022-0391: CVE-2022-0391 affecting package python2 2.7.18-14. A patched version of the package is available. + +CVE-2021-41617: (no description available) + +CVE-2021-40211: An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c. + +CVE-2021-39537: CVE-2021-39537 affecting package ncurses for versions less than 6.2-6. A patched version of the package is available. + +CVE-2021-3864: A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges. + +CVE-2021-3807: ansi-regex is vulnerable to Inefficient Regular Expression Complexity + +CVE-2021-3737: (no description available) + +CVE-2021-3575: (no description available) + +CVE-2021-33560: Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP. + +CVE-2021-20313: (no description available) + +CVE-2021-20312: A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. + +CVE-2021-20309: (no description available) + +CVE-2021-20194: There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. + +CVE-2020-27815: A flaw was found in the JFS filesystem code. This flaw allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. + +CVE-2020-27752: (no description available) + +CVE-2020-26116: (no description available) + +CVE-2020-23109: Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file. + +CVE-2020-22218: CVE-2020-22218 affecting package libssh2 for versions less than 1.9.0-3. A patched version of the package is available. + +CVE-2020-19499: (no description available) + +CVE-2020-19498: (no description available) + +CVE-2020-1751: An out-of-bounds write vulnerability was found in glibc when handling signal trampolines on PowerPC. The backtrace function did not properly check the array bounds when storing the frame address resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability. + +CVE-2020-1749: A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. + +CVE-2020-16156: CPAN 2.28 allows Signature Verification Bypass. + +CVE-2020-16119: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196. + +CVE-2020-11080: (no description available) + +CVE-2020-10735: (no description available) + +CVE-2019-3844: (no description available) + +CVE-2019-3843: (no description available) + +CVE-2019-20907: A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. + +CVE-2019-17498: In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. + +CVE-2019-15847: CVE-2019-15847 affecting package gcc 9.1.0-7. A patched version of the package is available. + +CVE-2019-14899: (no description available) + +CVE-2019-1387: (no description available) + +CVE-2019-13115: In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855. + +CVE-2019-12290: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated. + +CVE-2018-14625: A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients. + +CVE-2018-12886: (no description available) + +CVE-2018-10902: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. + +CVE-2017-6264: An elevation of privilege vulnerability exists in the NVIDIA GPU driver (gm20b_clk_throt_set_cdev_state), where an out of bound memory read is used as a function pointer could lead to code execution in the kernel.This issue is rated as high because it could allow a local malicious application to execute arbitrary code within the context of a privileged process. Product: Android. Version: N/A. Android ID: A-34705430. References: N-CVE-2017-6264. + +CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. + +CVE-2016-3699: The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. + +CVE-2015-20107: (no description available) + +CVE-2026-59875: (no description available) + +CVE-2026-59871: (no description available) + +CVE-2026-58045: (no description available) + +CVE-2026-58042: (no description available) + +CVE-2026-58041: (no description available) + +CVE-2026-58040: An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). + +This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. + +CVE-2026-56860: Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. + +CVE-2026-56858: A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions. + +CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +CVE-2026-53655: node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16. + +CVE-2026-53489: (no description available) + +CVE-2026-52972: A flaw was found in the Linux kernel's `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability. + +CVE-2026-41907: A flaw was found in uuid. The library's versions v3, v5, and v6 do not adequately check the size of external memory buffers provided by applications. This oversight allows the library to write data beyond the designated buffer limits without signaling an error. Such out-of-bounds writes can lead to data corruption, unintended information disclosure, or disrupt application availability. + +CVE-2026-33750: (no description available) + +CVE-2026-3184: (no description available) + +CVE-2026-21717: (no description available) + +CVE-2026-21714: (no description available) + +CVE-2026-21713: (no description available) + +CVE-2025-69873: (no description available) + +CVE-2025-60876: (no description available) + +CVE-2025-23167: (no description available) + +CVE-2025-23085: CVE-2025-23085 affecting package nodejs for versions less than 20.14.0-5. A patched version of the package is available. + +CVE-2025-15284: (no description available) + +CVE-2024-34397: An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact. + +CVE-2024-33600: (no description available) + +CVE-2024-28863: (no description available) + +CVE-2024-28182: (no description available) + +CVE-2024-27982: An HTTP Request Smuggling vulnerability was found in Node.js due to Content-Length Obfuscation in the HTTP server. Malformed headers, particularly if a space is inserted before a content-length header, can result in HTTP request smuggling. This flaw allows attackers to inject a second request within the body of the first and poison web caches, bypass web application firewalls, and execute Cross-site scripting (XSS) attacks. + +CVE-2024-26462: (no description available) + +CVE-2024-26458: (no description available) + +CVE-2024-2511: (no description available) + +CVE-2024-22365: (no description available) + +CVE-2024-2236: (no description available) + +CVE-2024-22025: CVE-2024-22025 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue. + +CVE-2024-22020: A security flaw in Node.js allows a bypass of network import restrictions. +By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. +Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. +Exploiting this flaw can violate network import security, posing a risk to developers and servers. + +CVE-2024-21096: (no description available) + +CVE-2024-0727: (no description available) + +CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. + +The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive. + +CVE-2023-7008: CVE-2023-7008 affecting package systemd for versions less than 250.3-22. A patched version of the package is available. + +CVE-2023-6679: A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This issue could be exploited to trigger a denial of service. + +CVE-2023-6277: (no description available) + +CVE-2023-6240: (no description available) + +CVE-2023-6238: A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption. + +CVE-2023-6176: (no description available) + +CVE-2023-5981: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. + +CVE-2023-5870: (no description available) + +CVE-2023-5868: A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory. + +CVE-2023-5678: (no description available) + +CVE-2023-5341: (no description available) + +CVE-2023-52904: In the Linux kernel, the following vulnerability has been resolved: + +ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() + +The subs function argument may be NULL, so do not use it before the NULL check. + +CVE-2023-51385: CVE-2023-51385 affecting package openssh for versions less than 8.9p1-3. A patched version of the package is available. + +CVE-2023-50495: (no description available) + +CVE-2023-4813: (no description available) + +CVE-2023-4806: A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. + +CVE-2023-47471: (no description available) + +CVE-2023-4641: CVE-2023-4641 affecting package shadow-utils for versions less than 4.9-14. A patched version of the package is available. + +CVE-2023-46218: (no description available) + +CVE-2023-45322: (no description available) + +CVE-2023-43786: (no description available) + +CVE-2023-43785: A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system. + +CVE-2023-4155: (no description available) + +CVE-2023-41175: A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. + +CVE-2023-40745: CVE-2023-40745 affecting package libtiff for versions less than 4.6.0-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-4039: (no description available) + +CVE-2023-40217: (no description available) + +CVE-2023-4010: A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service. + +CVE-2023-39804: A flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service. + +CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. + +CVE-2023-39333: (no description available) + +CVE-2023-3817: (no description available) + +CVE-2023-3773: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace. + +CVE-2023-3772: (no description available) + +CVE-2023-3618: A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. + +CVE-2023-36054: (no description available) + +CVE-2023-3576: A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service. + +CVE-2023-3446: Issue summary: Checking excessively long DH keys or parameters may be very slow. + +Impact summary: Applications that use the functions DH_check(), DH_check_ex() +or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long +delays. Where the key or parameters that are being checked have been obtained +from an untrusted source this may lead to a Denial of Service. + +The function DH_check() performs various checks on DH parameters. One of those +checks confirms that the modulus ('p' parameter) is not too large. Trying to use +a very large modulus is slow and OpenSSL will not normally use a modulus which +is over 10,000 bits in length. + +However the DH_check() function checks numerous aspects of the key or parameters +that have been supplied. Some of those checks use the supplied modulus value +even if it has already been found to be too large. + +An application that calls DH_check() and supplies a key or parameters obtained +from an untrusted source could be vulernable to a Denial of Service attack. + +The function DH_check() is itself called by a number of other OpenSSL functions. +An application calling any of those other functions may similarly be affected. +The other functions affected by this are DH_check_ex() and +EVP_PKEY_param_check(). + +Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications +when using the '-check' option. + +The OpenSSL SSL/TLS implementation is not affected by this issue. +The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. + +CVE-2023-34151: (no description available) + +CVE-2023-3397: A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information. + +CVE-2023-3316: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. + +CVE-2023-32665: (no description available) + +CVE-2023-32611: (no description available) + +CVE-2023-29659: A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service. + +CVE-2023-29469: (no description available) + +CVE-2023-2908: (no description available) + +CVE-2023-2898: (no description available) + +CVE-2023-28484: (no description available) + +CVE-2023-28321: (no description available) + +CVE-2023-28155: The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. + +CVE-2023-27538: CVE-2023-27538 affecting package cmake for versions less than 3.28.2-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-27536: CVE-2023-27536 affecting package cmake for versions less than 3.21.4-13. A patched version of the package is available. + +CVE-2023-27535: A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic settings are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level. + +CVE-2023-27102: (no description available) + +CVE-2023-27043: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. + +CVE-2023-26966: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. + +CVE-2023-26965: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. + +CVE-2023-2650: CVE-2023-2650 affecting package edk2 for versions less than 20230301gitf80f052277c8-37. A patched version of the package is available. + +CVE-2023-26136: (no description available) + +CVE-2023-25433: CVE-2023-25433 affecting package libtiff for versions less than 4.5.1-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-2455: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. + +CVE-2023-22084: CVE-2023-22084 affecting package mysql for versions less than 8.0.35-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. + +CVE-2023-1076: A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and get unauthorized access to some resources. + +CVE-2023-1074: (no description available) + +CVE-2023-1073: (no description available) + +CVE-2023-0466: (no description available) + +CVE-2023-0465: (no description available) + +CVE-2022-48566: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. + +CVE-2022-47015: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. + +CVE-2022-4543: CVE-2022-4543 affecting package kernel 5.15.202.1-1. No patch is available currently. + +CVE-2022-4415: (no description available) + +CVE-2022-4382: (no description available) + +CVE-2022-42895: There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. +We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url + +CVE-2022-40090: An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. + +CVE-2022-3821: An off-by-one error flaw was found in systemd in the format_timespan() function of time-util.c. This flaw allows an attacker to supply specific values for time and accuracy, leading to a buffer overrun in format_timespan(), leading to a denial of service. + +CVE-2022-38096: A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). + +CVE-2022-3646: A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. + +CVE-2022-36402: An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). + +CVE-2022-3630: (no description available) + +CVE-2022-3621: (no description available) + +CVE-2022-3619: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability. + +CVE-2022-3567: (no description available) + +CVE-2022-3523: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211020. + +CVE-2022-3435: (no description available) + +CVE-2022-33987: (no description available) + +CVE-2022-33068: A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service (DoS) via unspecified vectors. + +CVE-2022-2663: (no description available) + +CVE-2022-2308: (no description available) + +CVE-2022-1122: A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service. + +CVE-2022-0286: A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service. + +CVE-2021-46822: The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c. + +CVE-2021-46312: (no description available) + +CVE-2021-46310: (no description available) + +CVE-2021-4218: (no description available) + +CVE-2021-4189: (no description available) + +CVE-2021-3997: CVE-2021-3997 affecting package systemd for versions less than 250.3-21. An upgraded version of the package is available that resolves this issue. + +CVE-2021-37600: (no description available) + +CVE-2021-3759: (no description available) + +CVE-2021-3733: There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. + +CVE-2021-3714: A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged. + +CVE-2021-3564: A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. + +CVE-2021-31879: GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. + +CVE-2021-29338: There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability. + +CVE-2021-23336: (no description available) + +CVE-2021-20265: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability. + +CVE-2021-20246: A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. + +CVE-2021-20245: A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. + +CVE-2021-20244: A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. + +CVE-2021-20243: (no description available) + +CVE-2021-20241: A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. + +CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability. + +CVE-2020-8834: A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service. + +CVE-2020-8492: (no description available) + +CVE-2020-35538: A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo. + +CVE-2020-25664: (no description available) + +CVE-2020-21047: The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks. + +CVE-2020-19189: Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. + +CVE-2020-14155: libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. + +CVE-2020-10742: A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability. + +CVE-2019-3887: A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue. + +CVE-2019-3819: (no description available) + +CVE-2019-3016: (no description available) + +CVE-2019-20795: iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability. + +CVE-2019-13627: It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7. + +CVE-2019-12973: (no description available) + +CVE-2018-10882: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. + +CVE-2018-10876: A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. + +CVE-2018-10840: Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image. + +CVE-2017-1000377: (no description available) + +CVE-2017-1000255: On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable. + +CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. + +CVE-2016-3709: Possible cross-site scripting vulnerability in libxml after commit 960f0e2. + +CVE-2016-3695: (no description available) + +CVE-2016-0774: (no description available) + +CVE-2009-3546: The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information. + +CVE-2007-3996: Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function. + +CVE-2026-58044: A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications. + +CVE-2026-58039: A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system. + +CVE-2026-56847: CVE-2026-56847 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue. + +CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. + +CVE-2026-21716: (no description available) + +CVE-2026-21715: (no description available) + +CVE-2025-5889: A denial-of-service (DoS) vulnerability has been identified in the brace-expansion JavaScript package. This issue occurs due to inefficient regular expression complexity, which can be exploited by an attacker providing specially crafted input. Such input could lead to excessive processing time and resource consumption, rendering applications that utilize this package unresponsive and causing a denial-of-service condition. + +CVE-2025-46394: (no description available) + +CVE-2025-23165: (no description available) + +CVE-2024-58251: (no description available) + +CVE-2024-32020: (no description available) + +CVE-2024-31047: (no description available) + +CVE-2024-28085: CVE-2024-28085 affecting package util-linux for versions less than 2.37.4-9. A patched version of the package is available. + +CVE-2023-51792: (no description available) + +CVE-2023-42282: (no description available) + +CVE-2023-4016: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. + +CVE-2023-38546: This flaw allows an attacker to insert cookies at will into a running program +using libcurl, if the specific series of conditions are met. + +libcurl performs transfers. In its API, an application creates "easy handles" +that are the individual handles for single transfers. + +libcurl provides a function call that duplicates en easy handle called +[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). + +If a transfer has cookies enabled when the handle is duplicated, the +cookie-enable state is also cloned - but without cloning the actual +cookies. If the source handle did not read any cookies from a specific file on +disk, the cloned version of the handle would instead store the file name as +`none` (using the four ASCII letters, no quotes). + +Subsequent use of the cloned handle that does not explicitly set a source to +load cookies from would then inadvertently load cookies from a file named +`none` - if such a file exists and is readable in the current directory of the +program using libcurl. And if using the correct file format of course. + +CVE-2023-36308: (no description available) + +CVE-2023-29383: (no description available) + +CVE-2023-28322: An information disclosure vulnerability exists in curl . The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: . + +CVE-2021-36087: (no description available) + +CVE-2021-36086: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). + +CVE-2021-36085: (no description available) + +CVE-2021-36084: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). + +CVE-2020-12825: libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. + +CVE-2019-6988: (no description available) + +CVE-2019-6462: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized. + +CVE-2019-6461: (no description available) + +CVE-2019-17543: LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk." + +CVE-2019-14855: A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. + +CVE-2018-7169: (no description available) + +CVE-2018-6559: (no description available) + +CVE-2018-18064: (no description available) + +CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file. -CVE-2019-1010023: GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. +CVE-2017-8834: (no description available) -CVE-2019-1010022: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. +CVE-2017-7475: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. -CVE-2019-9192: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern +CVE-2016-2781: (no description available) -CVE-2025-5278: A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data. +CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. -CVE-2011-4116: _is_safe in the File::Temp module for Perl does not properly handle symlinks. +CVE-2007-3476: (no description available) + +CVE-2024-34459: (no description available) + +CVE-2024-28757: (no description available) + +CVE-2024-25269: libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack. + +CVE-2024-25260: CVE-2024-25260 affecting package elfutils for versions less than 0.189-6. A patched version of the package is available. + +CVE-2024-2379: CVE-2024-2379 affecting package cmake for versions less than 3.30.3-2. An upgraded version of the package is available that resolves this issue. + +CVE-2023-6597: CVE-2023-6597 affecting package python3 for versions less than 3.9.19-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-6228: (no description available) + +CVE-2023-52426: CVE-2023-52426 affecting package expat for versions less than 2.6.2-1. An upgraded version of the package is available that resolves this issue. + +CVE-2023-51767: (no description available) + +CVE-2023-48795: (no description available) + +CVE-2023-37769: stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c. + +CVE-2023-34152: (no description available) + +CVE-2023-3164: A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. + +CVE-2023-31486: HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. + +CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." CVE-2023-31438: An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." -CVE-2021-45710: An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption. +CVE-2023-31437: (no description available) + +CVE-2023-30775: (no description available) + +CVE-2023-28320: (no description available) + +CVE-2023-25588: A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service. + +CVE-2023-25586: (no description available) + +CVE-2023-25585: (no description available) + +CVE-2023-25584: (no description available) + +CVE-2023-1972: A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. + +CVE-2023-1916: A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. + +CVE-2023-1579: Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64. + +CVE-2022-48564: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. + +CVE-2022-48303: (no description available) + +CVE-2022-48065: (no description available) + +CVE-2022-48064: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. + +CVE-2022-48063: CVE-2022-48063 affecting package binutils for versions less than 2.37-10. A patched version of the package is available. + +CVE-2022-47696: (no description available) + +CVE-2022-47695: (no description available) + +CVE-2022-47673: An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts. + +CVE-2022-47011: A memory leak flaw was found in binutils. This flaw allows an attacker to use a set of steps to trigger a memory leak and perform a denial of service, resulting in a loss of the system's availability. + +CVE-2022-47010: An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. + +CVE-2022-47008: An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. + +CVE-2022-47007: An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. + +CVE-2022-45703: Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c. + +CVE-2022-44840: Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. + +CVE-2022-4285: (no description available) + +CVE-2022-41409: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. + +CVE-2022-38533: CVE-2022-38533 affecting package binutils for versions less than 2.37-4. A patched version of the package is available. + +CVE-2022-35737: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. + +CVE-2022-35206: Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c. + +CVE-2022-35205: An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. + +CVE-2022-3219: (no description available) + +CVE-2022-31782: (no description available) + +CVE-2022-2953: (no description available) + +CVE-2022-2521: It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. + +CVE-2022-2520: (no description available) + +CVE-2022-2519: There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 + +CVE-2022-24975: (no description available) + +CVE-2022-1210: A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used. + +CVE-2022-1056: (no description available) + +CVE-2022-0563: CVE-2022-0563 affecting package util-linux 2.32.1-6. A patched version of the package is available. + +CVE-2021-46195: GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources. + +CVE-2021-46174: Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. + +CVE-2021-45346: (no description available) + +CVE-2021-45261: (no description available) + +CVE-2021-45078: An out-of-bounds flaw was found in binutils’ stabs functionality. The attack needs to be initiated locally where an attacker could convince a victim to read a specially crafted file that is processed by objdump, leading to the disclosure of memory and possibly leading to the execution of arbitrary code or causing the utility to crash. + +CVE-2021-4217: CVE-2021-4217 affecting package unzip 6.0-18. A patched version of the package is available. + +CVE-2021-4214: A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service. + +CVE-2021-3826: (no description available) + +CVE-2021-36690: (no description available) + +CVE-2021-36368: ** DISPUTED ** An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed." + +CVE-2021-3549: (no description available) + +CVE-2021-3530: (no description available) + +CVE-2021-3426: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. + +CVE-2021-33294: In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file. + +CVE-2021-32256: (no description available) + +CVE-2021-31239: (no description available) + +CVE-2021-28861: (no description available) + +CVE-2021-26945: An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. + +CVE-2021-22923: A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user's knowledge. The highest threat from this vulnerability is to confidentiality. + +CVE-2021-22922: (no description available) + +CVE-2021-20311: (no description available) + +CVE-2021-20304: A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability. + +CVE-2021-20294: A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability. + +CVE-2021-20284: (no description available) + +CVE-2021-20197: CVE-2021-20197 affecting package crash for versions less than 8.0.4-4. An upgraded version of the package is available that resolves this issue. + +CVE-2021-20193: (no description available) + +CVE-2020-35522: (no description available) + +CVE-2020-35521: (no description available) + +CVE-2020-35507: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. + +CVE-2020-35496: There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. + +CVE-2020-35495: (no description available) + +CVE-2020-35494: (no description available) + +CVE-2020-35493: A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. + +CVE-2020-35457: GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries()." The researcher states that this pattern is undocumented + +CVE-2020-35448: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. + +CVE-2020-35342: (no description available) + +CVE-2020-27755: (no description available) + +CVE-2020-27753: (no description available) + +CVE-2020-27619: In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. + +CVE-2020-21490: An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled. + +CVE-2020-19909: Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error. + +CVE-2020-19726: (no description available) + +CVE-2020-19724: (no description available) + +CVE-2020-17541: CVE-2020-17541 affecting package libjpeg-turbo 2.0.0-7. A patched version of the package is available. + +CVE-2020-16599: A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file. + +CVE-2020-16593: A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file. + +CVE-2020-16592: (no description available) + +CVE-2020-16591: A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif. + +CVE-2020-16590: A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file. + +CVE-2020-15778: ** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." + +CVE-2020-15719: (no description available) + +CVE-2020-14145: (no description available) + +CVE-2020-13631: (no description available) + +CVE-2020-13529: (no description available) + +CVE-2020-12062: (no description available) + +CVE-2020-11656: (no description available) + +CVE-2019-9923: (no description available) + +CVE-2019-9893: libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations. + +CVE-2019-9674: (no description available) + +CVE-2019-9192: (no description available) + +CVE-2019-9077: CVE-2019-9077 affecting package binutils 2.32-5. A patched version of the package is available. + +CVE-2019-9075: (no description available) + +CVE-2019-9074: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c. + +CVE-2019-9073: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allocation in _bfd_elf_slurp_version_tables in elf.c. + +CVE-2019-9071: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes in cp-demangle.c after many recursive calls. + +CVE-2019-9070: (no description available) + +CVE-2019-8457: SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. + +CVE-2019-6129: ** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer." + +CVE-2019-6110: (no description available) + +CVE-2019-25042: Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited + +CVE-2019-25041: (no description available) + +CVE-2019-25040: Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited -CVE-2011-3374: It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. +CVE-2019-25039: (no description available) + +CVE-2019-25038: (no description available) + +CVE-2019-25037: ** DISPUTED ** Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. + +CVE-2019-25036: Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited + +CVE-2019-25035: ** DISPUTED ** Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. + +CVE-2019-25034: (no description available) + +CVE-2019-25033: ** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. + +CVE-2019-25032: (no description available) + +CVE-2019-25031: Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation + +CVE-2019-20838: (no description available) + +CVE-2019-20386: A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free. + +CVE-2019-19924: SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. + +CVE-2019-19882: shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8). + +CVE-2019-19645: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. + +CVE-2019-19603: (no description available) + +CVE-2019-19244: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. + +CVE-2019-18934: (no description available) + +CVE-2019-18348: (no description available) + +CVE-2019-18276: (no description available) + +CVE-2019-17451: (no description available) + +CVE-2019-17450: (no description available) + +CVE-2019-16905: OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. + +CVE-2019-16709: (no description available) + +CVE-2019-14444: apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf. + +CVE-2019-14250: (no description available) + +CVE-2019-13310: (no description available) + +CVE-2019-12972: An out-of-bounds read was discovered in Binutils while it processes a malformed ELF relocatable file (.o file). A victim user who uses Binutils tools (size, gdb, readelf) to analyze untrusted binaries, may be vulnerable to a denial of service attack. + +CVE-2019-11360: A buffer overflow flaw was found in iptables-restore. This flaw allows a local attacker with sufficiently high privileges, such as root, to provide a specially crafted file, causing a program crash or potential code execution. The highest threat from this vulnerability is to system availability. + +CVE-2019-1010204: GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened. + +CVE-2019-1010180: CVE-2019-1010180 affecting package gdb 8.3-4. A patched version of the package is available. + +CVE-2019-1010025: (no description available) + +CVE-2019-1010024: (no description available) + +CVE-2019-1010023: ** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat." + +CVE-2019-1010022: (no description available) + +CVE-2018-9996: (no description available) + +CVE-2018-9138: (no description available) + +CVE-2018-7648: (no description available) + +CVE-2018-6952: (no description available) + +CVE-2018-6951: (no description available) + +CVE-2018-6829: cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation. + +CVE-2018-5727: In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. + +CVE-2018-5709: (no description available) + +CVE-2018-20846: Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). + +CVE-2018-20845: Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). + +CVE-2018-20796: CVE-2018-20796 affecting package glibc 2.28-24. A patched version of the package is available. + +CVE-2018-20712: (no description available) + +CVE-2018-20673: The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. + +CVE-2018-20671: load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size. + +CVE-2018-20651: (no description available) + +CVE-2018-20623: In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file. + +CVE-2018-20002: The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm. + +CVE-2018-19932: (no description available) + +CVE-2018-19931: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. + +CVE-2018-18701: (no description available) + +CVE-2018-18700: (no description available) + +CVE-2018-18607: (no description available) + +CVE-2018-18606: An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. + +CVE-2018-18605: A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. + +CVE-2018-18484: An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type. + +CVE-2018-18483: The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt. + +CVE-2018-18443: OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by exrmultiview. + +CVE-2018-18309: (no description available) + +CVE-2018-17985: (no description available) + +CVE-2018-17794: (no description available) + +CVE-2018-17360: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump. + +CVE-2018-17359: (no description available) + +CVE-2018-17358: (no description available) + +CVE-2018-16376: An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact. + +CVE-2018-16375: (no description available) + +CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.' + +CVE-2018-15607: In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. + +CVE-2018-14550: An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png. + +CVE-2018-14048: An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image. + +CVE-2018-12934: remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. + +CVE-2018-12699: (no description available) + +CVE-2018-12698: (no description available) + +CVE-2018-12697: A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump. + +CVE-2018-11813: libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. + +CVE-2018-10126: ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c. + +CVE-2018-1000876: (no description available) + +CVE-2018-1000654: GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file. + +CVE-2018-1000021: GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack). + +CVE-2017-9937: (no description available) + +CVE-2017-9117: In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff. + +CVE-2017-7275: The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866. + +CVE-2017-7246: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. + +CVE-2017-7245: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. + +CVE-2017-5563: (no description available) CVE-2017-18018: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition. -CVE-2019-1010025: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability. +CVE-2017-17973: (no description available) + +CVE-2017-17522: (no description available) + +CVE-2017-17479: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution. + +CVE-2017-16232: LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue + +CVE-2017-16231: (no description available) + +CVE-2017-15232: (no description available) + +CVE-2017-14988: ** DISPUTED ** Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid. + +CVE-2017-14159: slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript. + +CVE-2017-13716: The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd). + +CVE-2017-11755: (no description available) + +CVE-2017-11754: (no description available) + +CVE-2017-11164: In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression. + +CVE-2016-9581: (no description available) + +CVE-2016-9580: (no description available) + +CVE-2016-9117: NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. + +CVE-2016-9116: (no description available) + +CVE-2016-9115: (no description available) + +CVE-2016-9114: (no description available) + +CVE-2016-9113: (no description available) + +CVE-2016-8678: The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file. NOTE: the vendor says "This is a Q64 issue and we do not support Q64." + +CVE-2016-20012: OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product + +CVE-2016-10506: (no description available) + +CVE-2016-10505: NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files. + +CVE-2015-9019: In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs. + +CVE-2015-3276: A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. + +CVE-2013-7040: Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150. + +CVE-2013-4392: (no description available) + +CVE-2013-4235: (no description available) + +CVE-2013-0340: expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. + +CVE-2012-2663: extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant. + +CVE-2012-0039: (no description available) + +CVE-2011-4116: _is_safe in the File::Temp module for Perl does not properly handle symlinks. + +CVE-2011-3389: (no description available) + +CVE-2011-3374: (no description available) + +CVE-2010-4756: (no description available) + +CVE-2010-4651: (no description available) + +CVE-2008-4108: Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory. + +CVE-2008-3234: (no description available) + +CVE-2008-3134: Multiple unspecified vulnerabilities in GraphicsMagick before 1.2.4 allow remote attackers to cause a denial of service (crash, infinite loop, or memory consumption) via (a) unspecified vectors in the (1) AVI, (2) AVS, (3) DCM, (4) EPT, (5) FITS, (6) MTV, (7) PALM, (8) RLA, and (9) TGA decoder readers; and (b) the GetImageCharacteristics function in magick/image.c, as reachable from a crafted (10) PNG, (11) JPEG, (12) BMP, or (13) TIFF file. + +CVE-2008-1688: Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries. + +CVE-2008-1687: The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename. -CVE-2022-0563: A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. +CVE-2007-5686: (no description available) -CVE-2013-4392: systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files. +CVE-2007-2768: OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. -CVE-2018-20796: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. +CVE-2007-2243: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483. CVE-2005-2541: Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. -CVE-2023-31437: An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." +CVE-2005-0406: A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image. -CVE-2025-62518: astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds. +GO-2026-5932: The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. -CVE-2025-59825: astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the Entry::allow_external_symlinks control (which defaults to true) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it. These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution. This issue has been patched in version 0.5.4. There is no workaround other than upgrading. +If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package. -CVE-2026-22863: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0. +CVE-2023-45918: ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. diff --git a/utilities/vulndata/vulndata.sh b/utilities/vulndata/vulndata.sh index 205988c..b6f46e4 100755 --- a/utilities/vulndata/vulndata.sh +++ b/utilities/vulndata/vulndata.sh @@ -9,11 +9,19 @@ # --------------------------------------------------------------------------- # --- Configuration --- -# put variables for username, password, and Anchore_URL in anchore.env file -if [ -f ./anchore.env ]; then +# Reuse ANCHORECTL_USERNAME / ANCHORECTL_PASSWORD / ANCHORECTL_URL if you already have +# anchorectl configured in your shell. Otherwise fall back to an anchore.env file with +# USERNAME, PASSWORD, and ANCHORE_URL (see README). +USERNAME="${ANCHORECTL_USERNAME:-$USERNAME}" +PASSWORD="${ANCHORECTL_PASSWORD:-$PASSWORD}" +ANCHORE_URL="${ANCHORECTL_URL:-$ANCHORE_URL}" + +if [[ -z "$USERNAME" || -z "$PASSWORD" || -z "$ANCHORE_URL" ]] && [ -f ./anchore.env ]; then source ./anchore.env -else - echo "Error: anchore.env file not found." +fi + +if [[ -z "$USERNAME" || -z "$PASSWORD" || -z "$ANCHORE_URL" ]]; then + echo "Error: missing credentials. Set ANCHORECTL_USERNAME, ANCHORECTL_PASSWORD, and ANCHORECTL_URL in your environment, or create an anchore.env file." exit 1 fi diff --git a/utilities/vulndata/vulndata_apps.py b/utilities/vulndata/vulndata_apps.py new file mode 100755 index 0000000..ca18460 --- /dev/null +++ b/utilities/vulndata/vulndata_apps.py @@ -0,0 +1,207 @@ +#!/usr/bin/env python3 +# --------------------------------------------------------------------------- +# Part of the Anchore Examples Repository. +# Licensed under the Apache License, Version 2.0 (the "License"). +# +# THIS FILE IS UNMAINTAINED AND PROVIDED "AS IS", WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND. USE AT YOUR OWN RISK. +# --------------------------------------------------------------------------- +""" +vulndata_apps.py — full NVD vulnerability descriptions for an Anchore +Enterprise 6.x Application Version. + +Enterprise 6's /apps/{app_id}/versions/{version_id}/vulnerabilities endpoint +only returns match metadata (severity, CVSS, EPSS, KEV, anchore_score) - no +description text. This script chains three calls to get from an app/version +name to full descriptions: + + 1. GET /apps?name= -> app_id + 2. GET /apps/{app_id}/versions?name= -> version_id + 3. GET /apps/{app_id}/versions/{version_id}/vulnerabilities -> vulnerability IDs + 4. GET /query/vulnerabilities?id= -> nvd_data[].description + +Prerequisites: python3 (3.8+, stdlib only - nothing to pip install). + +Usage: + vulndata_apps.py APP_NAME VERSION_NAME + vulndata_apps.py rust 2.0 + vulndata_apps.py rust 2.0 --output vulndata-rust.txt +""" + +import argparse +import base64 +import json +import os +import sys +import urllib.error +import urllib.parse +import urllib.request + +BATCH_SIZE = 50 + +# Same search order anchorectl itself uses for its config file. +ANCHORECTL_CONFIG_PATHS = [ + "./.anchorectl.yaml", + "./anchorectl.yaml", + "./.anchorectl/config.yaml", + os.path.expanduser("~/.anchorectl.yaml"), + os.path.expanduser("~/anchorectl.yaml"), + os.path.join( + os.environ.get("XDG_CONFIG_HOME", os.path.expanduser("~/.config")), + "anchorectl", + "config.yaml", + ), +] + + +def load_anchorectl_config(): + """Pull url/username/password out of an anchorectl config file. + + Only reads top-level (unindented) `key: value` lines - good enough for + the flat keys we need without pulling in a YAML dependency. + """ + for path in ANCHORECTL_CONFIG_PATHS: + if not os.path.isfile(path): + continue + values = {} + with open(path) as f: + for line in f: + if not line.strip() or line[0] in " \t#" or ":" not in line: + continue + key, _, value = line.partition(":") + values[key.strip()] = value.split("#")[0].strip().strip("'\"") + return values + return {} + + +def resolve_config(): + config = load_anchorectl_config() + username = os.environ.get("ANCHORECTL_USERNAME") or config.get("username") + password = os.environ.get("ANCHORECTL_PASSWORD") or config.get("password") + base_url = os.environ.get("ANCHORECTL_URL") or config.get("url") + + if not all([username, password, base_url]): + sys.exit( + "Error: missing credentials. Set ANCHORECTL_USERNAME, ANCHORECTL_PASSWORD, " + "and ANCHORECTL_URL in your environment, or configure them in ~/.anchorectl.yaml." + ) + + base_url = base_url.rstrip("/") + if not base_url.endswith("/v2"): + base_url += "/v2" + return base_url, username, password + + +def api_get(base_url, username, password, path, params=None): + url = f"{base_url}{path}" + if params: + url += "?" + urllib.parse.urlencode(params) + token = base64.b64encode(f"{username}:{password}".encode()).decode() + req = urllib.request.Request( + url, headers={"Accept": "application/json", "Authorization": f"Basic {token}"} + ) + try: + with urllib.request.urlopen(req, timeout=30) as resp: + return json.loads(resp.read()) + except urllib.error.HTTPError as e: + sys.exit(f"Error: {e.code} {e.reason} for {url}\n{e.read().decode(errors='replace')}") + except urllib.error.URLError as e: + sys.exit(f"Error: could not reach {url}: {e.reason}") + + +def get_app_id(base_url, username, password, app_name): + data = api_get(base_url, username, password, "/apps", {"name": app_name}) + items = data.get("items", []) + if not items: + sys.exit(f"Error: no app named {app_name!r} found") + return items[0]["system_metadata"]["id"] + + +def get_version_id(base_url, username, password, app_id, version_name): + data = api_get( + base_url, username, password, f"/apps/{app_id}/versions", {"name": version_name} + ) + items = data.get("items", []) + if not items: + sys.exit(f"Error: no version named {version_name!r} found") + return items[0]["system_metadata"]["id"] + + +def get_vulnerability_ids(base_url, username, password, app_id, version_id): + ids = [] + seen = set() + cursor = None + while True: + params = {"limit": 1000} + if cursor: + params["cursor"] = cursor + data = api_get( + base_url, + username, + password, + f"/apps/{app_id}/versions/{version_id}/vulnerabilities", + params, + ) + for item in data.get("items", []): + vid = item["vulnerability_id"] + if vid not in seen: + seen.add(vid) + ids.append(vid) + cursor = data.get("pagination", {}).get("next_cursor") + if not cursor: + break + return ids + + +def get_descriptions(base_url, username, password, vuln_ids): + descriptions = {} + for i in range(0, len(vuln_ids), BATCH_SIZE): + batch = vuln_ids[i : i + BATCH_SIZE] + data = api_get( + base_url, username, password, "/query/vulnerabilities", {"id": ",".join(batch)} + ) + for record in data.get("vulnerabilities", []): + vid = record.get("id") + if not vid or vid in descriptions: + continue + nvd_desc = next( + (n.get("description") for n in record.get("nvd_data") or [] if n.get("description")), + None, + ) + descriptions[vid] = nvd_desc or record.get("description") or "" + return descriptions + + +def main(): + parser = argparse.ArgumentParser(description=__doc__.strip().splitlines()[0]) + parser.add_argument("app_name", help="Application name (exact match)") + parser.add_argument("version_name", help="Application version name (exact match)") + parser.add_argument("-o", "--output", default="vulndata", help="Output file (default: vulndata)") + args = parser.parse_args() + + base_url, username, password = resolve_config() + + app_id = get_app_id(base_url, username, password, args.app_name) + version_id = get_version_id(base_url, username, password, app_id, args.version_name) + vuln_ids = get_vulnerability_ids(base_url, username, password, app_id, version_id) + + if not vuln_ids: + print(f"No vulnerabilities found for {args.app_name} {args.version_name}.") + return + + descriptions = get_descriptions(base_url, username, password, vuln_ids) + + header = "-" * 58 + lines = [header, f"Vulnerability Report for {args.app_name} {args.version_name}", header] + for vid in vuln_ids: + desc = descriptions.get(vid) or "(no description available)" + lines.append(f"{vid}: {desc}\n") + + output = "\n".join(lines) + print(output) + with open(args.output, "w") as f: + f.write(output + "\n") + + +if __name__ == "__main__": + main() From 0cf76aa23be107daba267f6e5dfdaeb7a548dbe4 Mon Sep 17 00:00:00 2001 From: Chadd Owen Date: Tue, 25 Aug 2026 13:16:27 -0600 Subject: [PATCH 2/2] removed vulndata Signed-off-by: Chadd Owen --- utilities/vulndata/vulndata | 1393 ----------------------------------- 1 file changed, 1393 deletions(-) delete mode 100644 utilities/vulndata/vulndata diff --git a/utilities/vulndata/vulndata b/utilities/vulndata/vulndata deleted file mode 100644 index e681625..0000000 --- a/utilities/vulndata/vulndata +++ /dev/null @@ -1,1393 +0,0 @@ ----------------------------------------------------------- -Vulnerability Report for Spectro 1.0.0 ----------------------------------------------------------- -CVE-2026-59873: A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable. - -CVE-2026-53492: (no description available) - -CVE-2026-50195: (no description available) - -CVE-2025-7783: A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data. -This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation. - -CVE-2024-38428: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. - -CVE-2024-32002: A vulnerability was found in Git. This vulnerability allows the malicious manipulation of repositories containing submodules, exploiting a bug that enables the writing of files into the .git/ directory instead of the submodule's intended worktree. This manipulation facilitates the execution of arbitrary code during the cloning process, bypassing user inspection and control. - -CVE-2023-45853: (no description available) - -CVE-2023-38408: (no description available) - -CVE-2023-32002: The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. - -CVE-2022-48565: (no description available) - -CVE-2021-3177: (no description available) - -CVE-2026-73566: (no description available) - -CVE-2026-69152: (no description available) - -CVE-2026-59874: (no description available) - -CVE-2026-58043: (no description available) - -CVE-2026-56865: A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy - -CVE-2026-56864: A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy - -CVE-2026-56862: (no description available) - -CVE-2026-56859: (no description available) - -CVE-2026-56853: When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. - -CVE-2026-56848: A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. - -CVE-2026-56846: A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**. - -CVE-2026-54876: Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. - -CVE-2026-48937: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**. - -CVE-2026-48617: A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. - -CVE-2026-46603: (no description available) - -CVE-2026-46600: (no description available) - -CVE-2026-39821: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". - -CVE-2026-33818: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. - -CVE-2026-31802: node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11. - -CVE-2026-29786: (no description available) - -CVE-2026-27904: (no description available) - -CVE-2026-27903: A flaw was found in minimatch, a utility for converting glob expressions into JavaScript regular expressions. A remote attacker can exploit this vulnerability by providing a specially crafted glob pattern containing multiple non-adjacent `**` (GLOBSTAR) segments. This can lead to unbounded recursive backtracking in the `matchOne()` function, causing a Denial of Service (DoS) by stalling the Node.js event loop for an extended period. - -CVE-2026-26996: A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive. - -CVE-2026-26960: (no description available) - -CVE-2026-24842: (no description available) - -CVE-2026-23950: (no description available) - -CVE-2026-23745: (no description available) - -CVE-2026-21710: (no description available) - -CVE-2026-21637: (no description available) - -CVE-2026-14456: (no description available) - -CVE-2026-14257: (no description available) - -CVE-2026-13149: (no description available) - -CVE-2026-12143: (no description available) - -CVE-2025-59466: A stack overflow flaw has been discovered in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions. - -CVE-2025-59465: CVE-2025-59465 affecting package nodejs for versions less than 20.14.0-11. A patched version of the package is available. - -CVE-2025-55131: (no description available) - -CVE-2025-23166: (no description available) - -CVE-2024-4741: (no description available) - -CVE-2024-4032: (no description available) - -CVE-2024-33655: (no description available) - -CVE-2024-33602: nscd: netgroup cache assumes NSS callback uses in-buffer strings - -The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory -when the NSS callback does not store all strings in the provided buffer. -The flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-2024-33601: (no description available) - -CVE-2024-33599: CVE-2024-33599 affecting package glibc for versions less than 2.35-7. A patched version of the package is available. - -CVE-2024-32465: (no description available) - -CVE-2024-32021: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning -will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. - -CVE-2024-32004: A vulnerability was found in Git. This vulnerability can be exploited by an unauthenticated attacker who places a specialized repository on the target's local system. If the victim clones this repository, the attacker can execute arbitrary code. - -CVE-2024-2961: (no description available) - -CVE-2024-29415: (no description available) - -CVE-2024-27983: CVE-2024-27983 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue. - -CVE-2024-26461: (no description available) - -CVE-2024-25062: (no description available) - -CVE-2024-2398: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. - -CVE-2024-22019: (no description available) - -CVE-2024-21892: (no description available) - -CVE-2024-21538: Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. - -CVE-2024-0985: (no description available) - -CVE-2024-0553: A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. - -CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5. - -CVE-2023-7104: (no description available) - -CVE-2023-6610: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. - -CVE-2023-6535: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service. - -CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory. - -CVE-2023-52425: libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. - -CVE-2023-52356: CVE-2023-52356 affecting package libtiff for versions less than 4.6.0-2. A patched version of the package is available. - -CVE-2023-52355: (no description available) - -CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. - -CVE-2023-50387: (no description available) - -CVE-2023-49468: Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc. - -CVE-2023-49467: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc. - -CVE-2023-49465: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc. - -CVE-2023-4863: (no description available) - -CVE-2023-46809: (no description available) - -CVE-2023-44487: (no description available) - -CVE-2023-43887: (no description available) - -CVE-2023-43787: A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. - -CVE-2023-39417: CVE-2023-39417 affecting package postgresql for versions less than 14.10-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-39180: (no description available) - -CVE-2023-39179: (no description available) - -CVE-2023-39176: (no description available) - -CVE-2023-38552: (no description available) - -CVE-2023-3640: A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled. However, despite this feature, there is still a risk of per-cpu entry area leaks. This issue could allow a local user to gain access to some important data with memory in an expected location and potentially escalate their privileges on the system. - -CVE-2023-32559: A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') to run arbitrary code outside of the limits defined in a policy.json file. - -CVE-2023-32006: CVE-2023-32006 affecting package nodejs18 for versions less than 18.17.1-2. An upgraded version of the package is available that resolves this issue. - -CVE-2023-31484: (no description available) - -CVE-2023-3138: CVE-2023-3138 affecting package libX11 for versions less than 1.6.12-6. A patched version of the package is available. - -CVE-2023-2953: (no description available) - -CVE-2023-29499: CVE-2023-29499 affecting package glib for versions less than 2.71.0-4. A patched version of the package is available. - -CVE-2023-29491: CVE-2023-29491 affecting package ncurses for versions less than 6.4-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-29007: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. - -CVE-2023-27534: A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. - -CVE-2023-27533: (no description available) - -CVE-2023-27103: Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc. - -CVE-2023-25652: (no description available) - -CVE-2023-25193: (no description available) - -CVE-2023-2454: A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code. - -CVE-2023-24329: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. - -CVE-2023-1999: (no description available) - -CVE-2023-0996: There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call. - -CVE-2023-0464: A security vulnerability has been identified in all supported versions - -of OpenSSL related to the verification of X.509 certificate chains -that include policy constraints. Attackers may be able to exploit this -vulnerability by creating a malicious certificate chain that triggers -exponential use of computational resources, leading to a denial-of-service -(DoS) attack on affected systems. - -Policy processing is disabled by default but can be enabled by passing -the `-policy' argument to the command line utilities or by calling the -`X509_VERIFY_PARAM_set1_policies()' function. - -CVE-2022-48622: (no description available) - -CVE-2022-48560: A use-after-free exists in Python through 3.9 via heappushpop in heapq. - -CVE-2022-48541: A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command. - -CVE-2022-45061: An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. - -CVE-2022-3636: (no description available) - -CVE-2022-3566: (no description available) - -CVE-2022-3534: A use-after-free flaw was found in btf_dump_name_dups in tools/lib/bpf/btf_dump.c in libbpf in the Linux Kernel. This issue occurs because the key stored in the hash table name_map is a string address, and the string memory is allocated by realloc() function. When the memory is resized by realloc() later, the old memory may be freed. - -CVE-2022-32547: (no description available) - -CVE-2022-32546: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. - -CVE-2022-32545: A vulnerability was found in ImageMagick. When crafted or untrusted input is processed, it causes issues outside the range of values of type 'unsigned char' at coders/psd.c. This issue leads to a negative impact on application availability or other problems related to undefined behavior. - -CVE-2022-28463: ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. - -CVE-2022-25883: CVE-2022-25883 affecting package nodejs for versions less than 16.20.1-2. A patched version of the package is available. - -CVE-2022-25881: (no description available) - -CVE-2022-2327: (no description available) - -CVE-2022-2309: (no description available) - -CVE-2022-1304: (no description available) - -CVE-2022-1247: (no description available) - -CVE-2022-0400: An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos. - -CVE-2022-0391: CVE-2022-0391 affecting package python2 2.7.18-14. A patched version of the package is available. - -CVE-2021-41617: (no description available) - -CVE-2021-40211: An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c. - -CVE-2021-39537: CVE-2021-39537 affecting package ncurses for versions less than 6.2-6. A patched version of the package is available. - -CVE-2021-3864: A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges. - -CVE-2021-3807: ansi-regex is vulnerable to Inefficient Regular Expression Complexity - -CVE-2021-3737: (no description available) - -CVE-2021-3575: (no description available) - -CVE-2021-33560: Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP. - -CVE-2021-20313: (no description available) - -CVE-2021-20312: A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. - -CVE-2021-20309: (no description available) - -CVE-2021-20194: There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. - -CVE-2020-27815: A flaw was found in the JFS filesystem code. This flaw allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. - -CVE-2020-27752: (no description available) - -CVE-2020-26116: (no description available) - -CVE-2020-23109: Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file. - -CVE-2020-22218: CVE-2020-22218 affecting package libssh2 for versions less than 1.9.0-3. A patched version of the package is available. - -CVE-2020-19499: (no description available) - -CVE-2020-19498: (no description available) - -CVE-2020-1751: An out-of-bounds write vulnerability was found in glibc when handling signal trampolines on PowerPC. The backtrace function did not properly check the array bounds when storing the frame address resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability. - -CVE-2020-1749: A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. - -CVE-2020-16156: CPAN 2.28 allows Signature Verification Bypass. - -CVE-2020-16119: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196. - -CVE-2020-11080: (no description available) - -CVE-2020-10735: (no description available) - -CVE-2019-3844: (no description available) - -CVE-2019-3843: (no description available) - -CVE-2019-20907: A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. - -CVE-2019-17498: In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. - -CVE-2019-15847: CVE-2019-15847 affecting package gcc 9.1.0-7. A patched version of the package is available. - -CVE-2019-14899: (no description available) - -CVE-2019-1387: (no description available) - -CVE-2019-13115: In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855. - -CVE-2019-12290: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated. - -CVE-2018-14625: A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients. - -CVE-2018-12886: (no description available) - -CVE-2018-10902: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. - -CVE-2017-6264: An elevation of privilege vulnerability exists in the NVIDIA GPU driver (gm20b_clk_throt_set_cdev_state), where an out of bound memory read is used as a function pointer could lead to code execution in the kernel.This issue is rated as high because it could allow a local malicious application to execute arbitrary code within the context of a privileged process. Product: Android. Version: N/A. Android ID: A-34705430. References: N-CVE-2017-6264. - -CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. - -CVE-2016-3699: The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. - -CVE-2015-20107: (no description available) - -CVE-2026-59875: (no description available) - -CVE-2026-59871: (no description available) - -CVE-2026-58045: (no description available) - -CVE-2026-58042: (no description available) - -CVE-2026-58041: (no description available) - -CVE-2026-58040: An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). - -This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. - -CVE-2026-56860: Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. - -CVE-2026-56858: A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions. - -CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. - -This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. - -CVE-2026-53655: node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16. - -CVE-2026-53489: (no description available) - -CVE-2026-52972: A flaw was found in the Linux kernel's `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability. - -CVE-2026-41907: A flaw was found in uuid. The library's versions v3, v5, and v6 do not adequately check the size of external memory buffers provided by applications. This oversight allows the library to write data beyond the designated buffer limits without signaling an error. Such out-of-bounds writes can lead to data corruption, unintended information disclosure, or disrupt application availability. - -CVE-2026-33750: (no description available) - -CVE-2026-3184: (no description available) - -CVE-2026-21717: (no description available) - -CVE-2026-21714: (no description available) - -CVE-2026-21713: (no description available) - -CVE-2025-69873: (no description available) - -CVE-2025-60876: (no description available) - -CVE-2025-23167: (no description available) - -CVE-2025-23085: CVE-2025-23085 affecting package nodejs for versions less than 20.14.0-5. A patched version of the package is available. - -CVE-2025-15284: (no description available) - -CVE-2024-34397: An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact. - -CVE-2024-33600: (no description available) - -CVE-2024-28863: (no description available) - -CVE-2024-28182: (no description available) - -CVE-2024-27982: An HTTP Request Smuggling vulnerability was found in Node.js due to Content-Length Obfuscation in the HTTP server. Malformed headers, particularly if a space is inserted before a content-length header, can result in HTTP request smuggling. This flaw allows attackers to inject a second request within the body of the first and poison web caches, bypass web application firewalls, and execute Cross-site scripting (XSS) attacks. - -CVE-2024-26462: (no description available) - -CVE-2024-26458: (no description available) - -CVE-2024-2511: (no description available) - -CVE-2024-22365: (no description available) - -CVE-2024-2236: (no description available) - -CVE-2024-22025: CVE-2024-22025 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue. - -CVE-2024-22020: A security flaw in Node.js allows a bypass of network import restrictions. -By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. -Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. -Exploiting this flaw can violate network import security, posing a risk to developers and servers. - -CVE-2024-21096: (no description available) - -CVE-2024-0727: (no description available) - -CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. - -The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive. - -CVE-2023-7008: CVE-2023-7008 affecting package systemd for versions less than 250.3-22. A patched version of the package is available. - -CVE-2023-6679: A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This issue could be exploited to trigger a denial of service. - -CVE-2023-6277: (no description available) - -CVE-2023-6240: (no description available) - -CVE-2023-6238: A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption. - -CVE-2023-6176: (no description available) - -CVE-2023-5981: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. - -CVE-2023-5870: (no description available) - -CVE-2023-5868: A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory. - -CVE-2023-5678: (no description available) - -CVE-2023-5341: (no description available) - -CVE-2023-52904: In the Linux kernel, the following vulnerability has been resolved: - -ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() - -The subs function argument may be NULL, so do not use it before the NULL check. - -CVE-2023-51385: CVE-2023-51385 affecting package openssh for versions less than 8.9p1-3. A patched version of the package is available. - -CVE-2023-50495: (no description available) - -CVE-2023-4813: (no description available) - -CVE-2023-4806: A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. - -CVE-2023-47471: (no description available) - -CVE-2023-4641: CVE-2023-4641 affecting package shadow-utils for versions less than 4.9-14. A patched version of the package is available. - -CVE-2023-46218: (no description available) - -CVE-2023-45322: (no description available) - -CVE-2023-43786: (no description available) - -CVE-2023-43785: A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system. - -CVE-2023-4155: (no description available) - -CVE-2023-41175: A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. - -CVE-2023-40745: CVE-2023-40745 affecting package libtiff for versions less than 4.6.0-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-4039: (no description available) - -CVE-2023-40217: (no description available) - -CVE-2023-4010: A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service. - -CVE-2023-39804: A flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service. - -CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. - -CVE-2023-39333: (no description available) - -CVE-2023-3817: (no description available) - -CVE-2023-3773: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace. - -CVE-2023-3772: (no description available) - -CVE-2023-3618: A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. - -CVE-2023-36054: (no description available) - -CVE-2023-3576: A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service. - -CVE-2023-3446: Issue summary: Checking excessively long DH keys or parameters may be very slow. - -Impact summary: Applications that use the functions DH_check(), DH_check_ex() -or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long -delays. Where the key or parameters that are being checked have been obtained -from an untrusted source this may lead to a Denial of Service. - -The function DH_check() performs various checks on DH parameters. One of those -checks confirms that the modulus ('p' parameter) is not too large. Trying to use -a very large modulus is slow and OpenSSL will not normally use a modulus which -is over 10,000 bits in length. - -However the DH_check() function checks numerous aspects of the key or parameters -that have been supplied. Some of those checks use the supplied modulus value -even if it has already been found to be too large. - -An application that calls DH_check() and supplies a key or parameters obtained -from an untrusted source could be vulernable to a Denial of Service attack. - -The function DH_check() is itself called by a number of other OpenSSL functions. -An application calling any of those other functions may similarly be affected. -The other functions affected by this are DH_check_ex() and -EVP_PKEY_param_check(). - -Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications -when using the '-check' option. - -The OpenSSL SSL/TLS implementation is not affected by this issue. -The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. - -CVE-2023-34151: (no description available) - -CVE-2023-3397: A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information. - -CVE-2023-3316: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. - -CVE-2023-32665: (no description available) - -CVE-2023-32611: (no description available) - -CVE-2023-29659: A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service. - -CVE-2023-29469: (no description available) - -CVE-2023-2908: (no description available) - -CVE-2023-2898: (no description available) - -CVE-2023-28484: (no description available) - -CVE-2023-28321: (no description available) - -CVE-2023-28155: The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. - -CVE-2023-27538: CVE-2023-27538 affecting package cmake for versions less than 3.28.2-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-27536: CVE-2023-27536 affecting package cmake for versions less than 3.21.4-13. A patched version of the package is available. - -CVE-2023-27535: A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic settings are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level. - -CVE-2023-27102: (no description available) - -CVE-2023-27043: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. - -CVE-2023-26966: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. - -CVE-2023-26965: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. - -CVE-2023-2650: CVE-2023-2650 affecting package edk2 for versions less than 20230301gitf80f052277c8-37. A patched version of the package is available. - -CVE-2023-26136: (no description available) - -CVE-2023-25433: CVE-2023-25433 affecting package libtiff for versions less than 4.5.1-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-2455: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. - -CVE-2023-22084: CVE-2023-22084 affecting package mysql for versions less than 8.0.35-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. - -CVE-2023-1076: A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and get unauthorized access to some resources. - -CVE-2023-1074: (no description available) - -CVE-2023-1073: (no description available) - -CVE-2023-0466: (no description available) - -CVE-2023-0465: (no description available) - -CVE-2022-48566: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. - -CVE-2022-47015: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. - -CVE-2022-4543: CVE-2022-4543 affecting package kernel 5.15.202.1-1. No patch is available currently. - -CVE-2022-4415: (no description available) - -CVE-2022-4382: (no description available) - -CVE-2022-42895: There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. -We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url - -CVE-2022-40090: An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. - -CVE-2022-3821: An off-by-one error flaw was found in systemd in the format_timespan() function of time-util.c. This flaw allows an attacker to supply specific values for time and accuracy, leading to a buffer overrun in format_timespan(), leading to a denial of service. - -CVE-2022-38096: A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). - -CVE-2022-3646: A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. - -CVE-2022-36402: An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). - -CVE-2022-3630: (no description available) - -CVE-2022-3621: (no description available) - -CVE-2022-3619: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability. - -CVE-2022-3567: (no description available) - -CVE-2022-3523: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211020. - -CVE-2022-3435: (no description available) - -CVE-2022-33987: (no description available) - -CVE-2022-33068: A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service (DoS) via unspecified vectors. - -CVE-2022-2663: (no description available) - -CVE-2022-2308: (no description available) - -CVE-2022-1122: A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service. - -CVE-2022-0286: A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service. - -CVE-2021-46822: The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c. - -CVE-2021-46312: (no description available) - -CVE-2021-46310: (no description available) - -CVE-2021-4218: (no description available) - -CVE-2021-4189: (no description available) - -CVE-2021-3997: CVE-2021-3997 affecting package systemd for versions less than 250.3-21. An upgraded version of the package is available that resolves this issue. - -CVE-2021-37600: (no description available) - -CVE-2021-3759: (no description available) - -CVE-2021-3733: There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. - -CVE-2021-3714: A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged. - -CVE-2021-3564: A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. - -CVE-2021-31879: GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. - -CVE-2021-29338: There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability. - -CVE-2021-23336: (no description available) - -CVE-2021-20265: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability. - -CVE-2021-20246: A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. - -CVE-2021-20245: A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. - -CVE-2021-20244: A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. - -CVE-2021-20243: (no description available) - -CVE-2021-20241: A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. - -CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability. - -CVE-2020-8834: A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service. - -CVE-2020-8492: (no description available) - -CVE-2020-35538: A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo. - -CVE-2020-25664: (no description available) - -CVE-2020-21047: The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks. - -CVE-2020-19189: Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. - -CVE-2020-14155: libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. - -CVE-2020-10742: A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability. - -CVE-2019-3887: A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue. - -CVE-2019-3819: (no description available) - -CVE-2019-3016: (no description available) - -CVE-2019-20795: iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability. - -CVE-2019-13627: It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7. - -CVE-2019-12973: (no description available) - -CVE-2018-10882: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. - -CVE-2018-10876: A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. - -CVE-2018-10840: Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image. - -CVE-2017-1000377: (no description available) - -CVE-2017-1000255: On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable. - -CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. - -CVE-2016-3709: Possible cross-site scripting vulnerability in libxml after commit 960f0e2. - -CVE-2016-3695: (no description available) - -CVE-2016-0774: (no description available) - -CVE-2009-3546: The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information. - -CVE-2007-3996: Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function. - -CVE-2026-58044: A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications. - -CVE-2026-58039: A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system. - -CVE-2026-56847: CVE-2026-56847 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue. - -CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. - -CVE-2026-21716: (no description available) - -CVE-2026-21715: (no description available) - -CVE-2025-5889: A denial-of-service (DoS) vulnerability has been identified in the brace-expansion JavaScript package. This issue occurs due to inefficient regular expression complexity, which can be exploited by an attacker providing specially crafted input. Such input could lead to excessive processing time and resource consumption, rendering applications that utilize this package unresponsive and causing a denial-of-service condition. - -CVE-2025-46394: (no description available) - -CVE-2025-23165: (no description available) - -CVE-2024-58251: (no description available) - -CVE-2024-32020: (no description available) - -CVE-2024-31047: (no description available) - -CVE-2024-28085: CVE-2024-28085 affecting package util-linux for versions less than 2.37.4-9. A patched version of the package is available. - -CVE-2023-51792: (no description available) - -CVE-2023-42282: (no description available) - -CVE-2023-4016: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. - -CVE-2023-38546: This flaw allows an attacker to insert cookies at will into a running program -using libcurl, if the specific series of conditions are met. - -libcurl performs transfers. In its API, an application creates "easy handles" -that are the individual handles for single transfers. - -libcurl provides a function call that duplicates en easy handle called -[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). - -If a transfer has cookies enabled when the handle is duplicated, the -cookie-enable state is also cloned - but without cloning the actual -cookies. If the source handle did not read any cookies from a specific file on -disk, the cloned version of the handle would instead store the file name as -`none` (using the four ASCII letters, no quotes). - -Subsequent use of the cloned handle that does not explicitly set a source to -load cookies from would then inadvertently load cookies from a file named -`none` - if such a file exists and is readable in the current directory of the -program using libcurl. And if using the correct file format of course. - -CVE-2023-36308: (no description available) - -CVE-2023-29383: (no description available) - -CVE-2023-28322: An information disclosure vulnerability exists in curl . The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: . - -CVE-2021-36087: (no description available) - -CVE-2021-36086: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). - -CVE-2021-36085: (no description available) - -CVE-2021-36084: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). - -CVE-2020-12825: libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. - -CVE-2019-6988: (no description available) - -CVE-2019-6462: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized. - -CVE-2019-6461: (no description available) - -CVE-2019-17543: LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk." - -CVE-2019-14855: A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. - -CVE-2018-7169: (no description available) - -CVE-2018-6559: (no description available) - -CVE-2018-18064: (no description available) - -CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file. - -CVE-2017-8834: (no description available) - -CVE-2017-7475: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. - -CVE-2016-2781: (no description available) - -CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. - -CVE-2007-3476: (no description available) - -CVE-2024-34459: (no description available) - -CVE-2024-28757: (no description available) - -CVE-2024-25269: libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack. - -CVE-2024-25260: CVE-2024-25260 affecting package elfutils for versions less than 0.189-6. A patched version of the package is available. - -CVE-2024-2379: CVE-2024-2379 affecting package cmake for versions less than 3.30.3-2. An upgraded version of the package is available that resolves this issue. - -CVE-2023-6597: CVE-2023-6597 affecting package python3 for versions less than 3.9.19-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-6228: (no description available) - -CVE-2023-52426: CVE-2023-52426 affecting package expat for versions less than 2.6.2-1. An upgraded version of the package is available that resolves this issue. - -CVE-2023-51767: (no description available) - -CVE-2023-48795: (no description available) - -CVE-2023-37769: stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c. - -CVE-2023-34152: (no description available) - -CVE-2023-3164: A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. - -CVE-2023-31486: HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. - -CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." - -CVE-2023-31438: An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." - -CVE-2023-31437: (no description available) - -CVE-2023-30775: (no description available) - -CVE-2023-28320: (no description available) - -CVE-2023-25588: A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service. - -CVE-2023-25586: (no description available) - -CVE-2023-25585: (no description available) - -CVE-2023-25584: (no description available) - -CVE-2023-1972: A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. - -CVE-2023-1916: A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. - -CVE-2023-1579: Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64. - -CVE-2022-48564: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. - -CVE-2022-48303: (no description available) - -CVE-2022-48065: (no description available) - -CVE-2022-48064: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. - -CVE-2022-48063: CVE-2022-48063 affecting package binutils for versions less than 2.37-10. A patched version of the package is available. - -CVE-2022-47696: (no description available) - -CVE-2022-47695: (no description available) - -CVE-2022-47673: An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts. - -CVE-2022-47011: A memory leak flaw was found in binutils. This flaw allows an attacker to use a set of steps to trigger a memory leak and perform a denial of service, resulting in a loss of the system's availability. - -CVE-2022-47010: An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. - -CVE-2022-47008: An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. - -CVE-2022-47007: An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. - -CVE-2022-45703: Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c. - -CVE-2022-44840: Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. - -CVE-2022-4285: (no description available) - -CVE-2022-41409: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. - -CVE-2022-38533: CVE-2022-38533 affecting package binutils for versions less than 2.37-4. A patched version of the package is available. - -CVE-2022-35737: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. - -CVE-2022-35206: Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c. - -CVE-2022-35205: An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. - -CVE-2022-3219: (no description available) - -CVE-2022-31782: (no description available) - -CVE-2022-2953: (no description available) - -CVE-2022-2521: It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. - -CVE-2022-2520: (no description available) - -CVE-2022-2519: There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 - -CVE-2022-24975: (no description available) - -CVE-2022-1210: A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used. - -CVE-2022-1056: (no description available) - -CVE-2022-0563: CVE-2022-0563 affecting package util-linux 2.32.1-6. A patched version of the package is available. - -CVE-2021-46195: GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources. - -CVE-2021-46174: Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. - -CVE-2021-45346: (no description available) - -CVE-2021-45261: (no description available) - -CVE-2021-45078: An out-of-bounds flaw was found in binutils’ stabs functionality. The attack needs to be initiated locally where an attacker could convince a victim to read a specially crafted file that is processed by objdump, leading to the disclosure of memory and possibly leading to the execution of arbitrary code or causing the utility to crash. - -CVE-2021-4217: CVE-2021-4217 affecting package unzip 6.0-18. A patched version of the package is available. - -CVE-2021-4214: A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service. - -CVE-2021-3826: (no description available) - -CVE-2021-36690: (no description available) - -CVE-2021-36368: ** DISPUTED ** An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed." - -CVE-2021-3549: (no description available) - -CVE-2021-3530: (no description available) - -CVE-2021-3426: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. - -CVE-2021-33294: In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file. - -CVE-2021-32256: (no description available) - -CVE-2021-31239: (no description available) - -CVE-2021-28861: (no description available) - -CVE-2021-26945: An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. - -CVE-2021-22923: A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user's knowledge. The highest threat from this vulnerability is to confidentiality. - -CVE-2021-22922: (no description available) - -CVE-2021-20311: (no description available) - -CVE-2021-20304: A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability. - -CVE-2021-20294: A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability. - -CVE-2021-20284: (no description available) - -CVE-2021-20197: CVE-2021-20197 affecting package crash for versions less than 8.0.4-4. An upgraded version of the package is available that resolves this issue. - -CVE-2021-20193: (no description available) - -CVE-2020-35522: (no description available) - -CVE-2020-35521: (no description available) - -CVE-2020-35507: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. - -CVE-2020-35496: There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. - -CVE-2020-35495: (no description available) - -CVE-2020-35494: (no description available) - -CVE-2020-35493: A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. - -CVE-2020-35457: GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries()." The researcher states that this pattern is undocumented - -CVE-2020-35448: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. - -CVE-2020-35342: (no description available) - -CVE-2020-27755: (no description available) - -CVE-2020-27753: (no description available) - -CVE-2020-27619: In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. - -CVE-2020-21490: An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled. - -CVE-2020-19909: Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error. - -CVE-2020-19726: (no description available) - -CVE-2020-19724: (no description available) - -CVE-2020-17541: CVE-2020-17541 affecting package libjpeg-turbo 2.0.0-7. A patched version of the package is available. - -CVE-2020-16599: A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file. - -CVE-2020-16593: A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file. - -CVE-2020-16592: (no description available) - -CVE-2020-16591: A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif. - -CVE-2020-16590: A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file. - -CVE-2020-15778: ** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." - -CVE-2020-15719: (no description available) - -CVE-2020-14145: (no description available) - -CVE-2020-13631: (no description available) - -CVE-2020-13529: (no description available) - -CVE-2020-12062: (no description available) - -CVE-2020-11656: (no description available) - -CVE-2019-9923: (no description available) - -CVE-2019-9893: libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations. - -CVE-2019-9674: (no description available) - -CVE-2019-9192: (no description available) - -CVE-2019-9077: CVE-2019-9077 affecting package binutils 2.32-5. A patched version of the package is available. - -CVE-2019-9075: (no description available) - -CVE-2019-9074: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c. - -CVE-2019-9073: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allocation in _bfd_elf_slurp_version_tables in elf.c. - -CVE-2019-9071: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes in cp-demangle.c after many recursive calls. - -CVE-2019-9070: (no description available) - -CVE-2019-8457: SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. - -CVE-2019-6129: ** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer." - -CVE-2019-6110: (no description available) - -CVE-2019-25042: Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited - -CVE-2019-25041: (no description available) - -CVE-2019-25040: Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited - -CVE-2019-25039: (no description available) - -CVE-2019-25038: (no description available) - -CVE-2019-25037: ** DISPUTED ** Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. - -CVE-2019-25036: Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited - -CVE-2019-25035: ** DISPUTED ** Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. - -CVE-2019-25034: (no description available) - -CVE-2019-25033: ** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. - -CVE-2019-25032: (no description available) - -CVE-2019-25031: Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation - -CVE-2019-20838: (no description available) - -CVE-2019-20386: A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free. - -CVE-2019-19924: SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. - -CVE-2019-19882: shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8). - -CVE-2019-19645: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. - -CVE-2019-19603: (no description available) - -CVE-2019-19244: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. - -CVE-2019-18934: (no description available) - -CVE-2019-18348: (no description available) - -CVE-2019-18276: (no description available) - -CVE-2019-17451: (no description available) - -CVE-2019-17450: (no description available) - -CVE-2019-16905: OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. - -CVE-2019-16709: (no description available) - -CVE-2019-14444: apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf. - -CVE-2019-14250: (no description available) - -CVE-2019-13310: (no description available) - -CVE-2019-12972: An out-of-bounds read was discovered in Binutils while it processes a malformed ELF relocatable file (.o file). A victim user who uses Binutils tools (size, gdb, readelf) to analyze untrusted binaries, may be vulnerable to a denial of service attack. - -CVE-2019-11360: A buffer overflow flaw was found in iptables-restore. This flaw allows a local attacker with sufficiently high privileges, such as root, to provide a specially crafted file, causing a program crash or potential code execution. The highest threat from this vulnerability is to system availability. - -CVE-2019-1010204: GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened. - -CVE-2019-1010180: CVE-2019-1010180 affecting package gdb 8.3-4. A patched version of the package is available. - -CVE-2019-1010025: (no description available) - -CVE-2019-1010024: (no description available) - -CVE-2019-1010023: ** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat." - -CVE-2019-1010022: (no description available) - -CVE-2018-9996: (no description available) - -CVE-2018-9138: (no description available) - -CVE-2018-7648: (no description available) - -CVE-2018-6952: (no description available) - -CVE-2018-6951: (no description available) - -CVE-2018-6829: cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation. - -CVE-2018-5727: In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. - -CVE-2018-5709: (no description available) - -CVE-2018-20846: Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). - -CVE-2018-20845: Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). - -CVE-2018-20796: CVE-2018-20796 affecting package glibc 2.28-24. A patched version of the package is available. - -CVE-2018-20712: (no description available) - -CVE-2018-20673: The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. - -CVE-2018-20671: load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size. - -CVE-2018-20651: (no description available) - -CVE-2018-20623: In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file. - -CVE-2018-20002: The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm. - -CVE-2018-19932: (no description available) - -CVE-2018-19931: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. - -CVE-2018-18701: (no description available) - -CVE-2018-18700: (no description available) - -CVE-2018-18607: (no description available) - -CVE-2018-18606: An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. - -CVE-2018-18605: A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. - -CVE-2018-18484: An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type. - -CVE-2018-18483: The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt. - -CVE-2018-18443: OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by exrmultiview. - -CVE-2018-18309: (no description available) - -CVE-2018-17985: (no description available) - -CVE-2018-17794: (no description available) - -CVE-2018-17360: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump. - -CVE-2018-17359: (no description available) - -CVE-2018-17358: (no description available) - -CVE-2018-16376: An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact. - -CVE-2018-16375: (no description available) - -CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.' - -CVE-2018-15607: In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. - -CVE-2018-14550: An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png. - -CVE-2018-14048: An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image. - -CVE-2018-12934: remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. - -CVE-2018-12699: (no description available) - -CVE-2018-12698: (no description available) - -CVE-2018-12697: A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump. - -CVE-2018-11813: libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. - -CVE-2018-10126: ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c. - -CVE-2018-1000876: (no description available) - -CVE-2018-1000654: GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file. - -CVE-2018-1000021: GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack). - -CVE-2017-9937: (no description available) - -CVE-2017-9117: In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff. - -CVE-2017-7275: The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866. - -CVE-2017-7246: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. - -CVE-2017-7245: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. - -CVE-2017-5563: (no description available) - -CVE-2017-18018: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition. - -CVE-2017-17973: (no description available) - -CVE-2017-17522: (no description available) - -CVE-2017-17479: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution. - -CVE-2017-16232: LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue - -CVE-2017-16231: (no description available) - -CVE-2017-15232: (no description available) - -CVE-2017-14988: ** DISPUTED ** Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid. - -CVE-2017-14159: slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript. - -CVE-2017-13716: The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd). - -CVE-2017-11755: (no description available) - -CVE-2017-11754: (no description available) - -CVE-2017-11164: In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression. - -CVE-2016-9581: (no description available) - -CVE-2016-9580: (no description available) - -CVE-2016-9117: NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. - -CVE-2016-9116: (no description available) - -CVE-2016-9115: (no description available) - -CVE-2016-9114: (no description available) - -CVE-2016-9113: (no description available) - -CVE-2016-8678: The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file. NOTE: the vendor says "This is a Q64 issue and we do not support Q64." - -CVE-2016-20012: OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product - -CVE-2016-10506: (no description available) - -CVE-2016-10505: NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files. - -CVE-2015-9019: In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs. - -CVE-2015-3276: A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. - -CVE-2013-7040: Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150. - -CVE-2013-4392: (no description available) - -CVE-2013-4235: (no description available) - -CVE-2013-0340: expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. - -CVE-2012-2663: extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant. - -CVE-2012-0039: (no description available) - -CVE-2011-4116: _is_safe in the File::Temp module for Perl does not properly handle symlinks. - -CVE-2011-3389: (no description available) - -CVE-2011-3374: (no description available) - -CVE-2010-4756: (no description available) - -CVE-2010-4651: (no description available) - -CVE-2008-4108: Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory. - -CVE-2008-3234: (no description available) - -CVE-2008-3134: Multiple unspecified vulnerabilities in GraphicsMagick before 1.2.4 allow remote attackers to cause a denial of service (crash, infinite loop, or memory consumption) via (a) unspecified vectors in the (1) AVI, (2) AVS, (3) DCM, (4) EPT, (5) FITS, (6) MTV, (7) PALM, (8) RLA, and (9) TGA decoder readers; and (b) the GetImageCharacteristics function in magick/image.c, as reachable from a crafted (10) PNG, (11) JPEG, (12) BMP, or (13) TIFF file. - -CVE-2008-1688: Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries. - -CVE-2008-1687: The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename. - -CVE-2007-5686: (no description available) - -CVE-2007-2768: OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. - -CVE-2007-2243: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483. - -CVE-2005-2541: Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. - -CVE-2005-0406: A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image. - -GO-2026-5932: The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. - -If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package. - -CVE-2023-45918: ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. -