CVE Vulnerability Catalog

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to a 32-bit imagespec, but libcineon maps the unsupported depth to an 8-byte value, so cineoninput::read_native_scanline() causes attacker-controlled data to be written beyond the 4-byte-per-pixel caller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted PSD with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_native_tiles() copies each row into the caller buffer using the padded whole-tile scanline_stride rather than user_scanline_bytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, an indexed PSD with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. When oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_header.pixel_bytes() rather than imagespec::tile_bytes(true), and a failed read can leave m_buf nonempty so a later call copies partially initialized data into the undersized caller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

kcp before 0.31.4 and 0.32.2 fails to strip inbound identity headers (X-Remote-User, X-Remote-Group, X-Remote-Extra-*) before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, gaining full privileges.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, an uncompressed 16-bit IFF image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes(), whose stride also includes z-buffer bytes. The oversized memcpy reads beyond the temporary heap buffer and copies adjacent memory into the output image.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted Cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while filling the fixed strings[8] array, writing pointers beyond the stack buffer and into adjacent state.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted FITS stream containing consecutive 2880-byte header blocks without the mandatory END keyword makes fitsinput::read_fits_header() call itself without a depth bound. Repeated recursive parsing exhausts the application stack.

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest authentication response can replay it against another URL served by the same realm, bypassing the per-request-URI binding and potentially gaining unauthorized read or write access. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.50.0.0.

In http4k prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefore receive weaker MD5-based verification.

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) generates error messages that include sensitive information about its environment, users, or associated data.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM WebSphere Application Server (versions 9.0 and 8.5) could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.