CVE Vulnerability Catalog

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where ptbl chunk validation uses the expression cues * 4 + cbsize without checking for 32-bit overflow. A crafted DLS file can wrap the expression and pass the chunk-size check, causing poolcues.resize(cues) to request about four gigabytes and read billions of entries beyond the chunk boundary.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where articulation chunk validation uses the expression cbsize + connblocks * 12 without checking for 32-bit overflow. A crafted DLS file can wrap the expression and bypass the chunk-size check, leading to approximately one billion 12-byte iterations beyond the chunk boundary.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the SF2 parser where the DMOD modulator count is computed as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file with a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations.

FluidSynth from 2.2.4 to 2.5.6 contains a vulnerability related to configuring synth.midi-channels above 16, allowing out-of-bounds reads and writes in the _fluid_player_t::channel_isplaying structure. This can lead to undefined behavior and compromise confidentiality, integrity, or availability. The issue is fixed in version 2.5.6.

FluidSynth from 1.1.2 to 2.5.6 has an out-of-bounds heap write vulnerability in the pitch_bend_range command handler where the channel argument is not bounds checked. This can lead to denial of service or potential code execution. The issue is remotely reachable via the TCP server or locally via the FluidSynth shell.

Suricata prior to 7.0.17 and 8.0.6 has a vulnerability in HTTP SWF decompression when the non-default swf-decompression feature and an unsafe decompress-depth are used. The allocation can use the configured depth instead of limiting to the Flash file's actual data requirement, leading to an integer-related heap buffer overflow and crash of Suricata.

Suricata versions 8.0.0 through 8.0.6 have a vulnerability in the DHCP and RDP parsers where stateless transactions are created without recording packet direction with AppLayerTxData::for_direction(). A sensor observing only one direction cannot mark the unseen direction inspected or free completed transactions, causing the per-flow transaction list to grow without bound.

Suricata prior to versions 7.0.17 and 8.0.6 has a vulnerability in src/ippair.c where crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because the IP address family was not compared before reusing IPPair-backed state. This can apply state from one IP family to another for xbits track ip_pair, FTP data expectations, and, on the 7.0 release line, thresholding, detection_filter, and rate_filter rules using track by_both.

CordysCRM prior to version 1.7.0 has a time-based blind SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING:UPDATE can place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40, C client, could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.