CVE Vulnerability Catalog

OpenEXR versions 3.4.0-3.4.12 have an out-of-bounds read vulnerability in the HTJ2K decoder because it does not check if the header-length field (PLEN) fits within the available buffer. A crafted EXR file can cause an out-of-bounds read.

PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 return stale heap data when reading a crafted deep EXR with layer-prefixed RGB channels. Prefixed channels are decoded into wrong lanes, leaving others uninitialized, potentially exposing memory contents.

OpenEXR versions before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13 have a crash vulnerability when processing a crafted EXR with an empty multiView header attribute. The viewFromChannelName() function indexes an empty vector, leading to a crash.

OpenEXR versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. A crafted RLE-compressed EXR can cause the unpacked size to truncate before allocation, leading to an out-of-bounds read and denial of service.

mediasoup versions npm 3.20.0-3.20.5 and Rust crate 0.22.0-0.22.4 have a vulnerability in the SCTP stack where state cookies are authenticated using only hardcoded values, allowing an attacker to forge a COOKIE-ECHO and establish an unauthorized SCTP association.

eml_parser before version 3.0.2 has a quadratic-time regex-based loop in the noparenthesis function when processing Received: headers with nested parentheses. A single header with 5000 nested parentheses causes about 1.3 seconds of CPU saturation per message, and doubling the nesting depth quadruples the running time. Attackers can submit small EML files that consume multiple seconds of processing time, causing latency and potential outages.

eml_parser before version 3.0.2 contains a stack overflow vulnerability in the header_fetch_parse function when parsing nested CFWS constructs in email headers. An attacker can send a specially crafted EML file that causes an unhandled RecursionError and aborts parsing of the entire message. This can disrupt SOC pipelines processing untrusted EML files.

eml_parser before version 3.0.2 contains a vulnerability in the clean_found_uri function that incorrectly validates URLs before unescaping HTML entities for colon, slash, or period characters. As a result, valid encoded URLs and their hostnames are rejected and omitted from extracted URL and domain lists. Email security gateways and SOC pipelines using these lists as indicators of compromise may fail to submit hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection.

In sublinear-time-solver before 1.6.0 and consciousness-explorer before 1.1.2, the export_state, import_state, saveVectorToFile, and loadVectorFromFile tools pass attacker-controlled file paths to filesystem operations without restrictions. An attacker can read, write, or overwrite any file accessible to the server process, causing confidentiality and integrity loss and possible service disruption.

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

In Emacs TRAMP, a vulnerability exists where login arguments are concatenated without proper sanitization and passed to a local shell. A local attacker can exploit this by processing maliciously crafted filenames, potentially leading to arbitrary code execution.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability without user interaction. The scope is changed.

Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability without user interaction. The scope is changed.

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation requires user interaction - the victim must open a malicious file.

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction - the victim must open a malicious file.