CVE Vulnerability Catalog

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

In libxml2 before 2.11.0, xmlXIncludeAddNode in xinclude.c has a use-after-free vulnerability.

In libxml2 before 2.12.10 and 2.13.6, a use-after-free exists in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

In libxml2 before 2.12.10 and 2.13.6, a stack-based buffer overflow exists in xmlSnprintfElements in valid.c. Exploitation requires DTD validation of an untrusted document or untrusted DTD. Similar to CVE-2017-9047.

In libxml2 before 2.13.8 and 2.14.2, out-of-bounds memory access occurs in the Python API due to an incorrect return value in xmlPythonFileRead and xmlPythonFileReadRaw.

In libxml2 before 2.13.8 and 2.14.2, a heap-based buffer under-read exists in xmlSchemaIDCFillNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.

In libxslt before 1.1.43, numbers.c has a use-after-free because in nested XPath evaluations, an XPath context node can be modified but never restored. Affects xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

The net-tools package up to version 2.10 does not properly validate the structure of /proc files, which may lead to errors when reading data.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, the convert.quoted-printable-decode filter can cause a buffer overread by one byte, potentially leading to crashes or disclosure of other memory areas.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, when using streams with a configured proxy and the request_fulluri option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to perform arbitrary HTTP requests through the proxy.

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

Vulnerability in Intel processors allows exposure of sensitive information via shared microarchitectural predictor state during transient execution in VMX non-root (guest) operation. An unprivileged software adversary with an authenticated user can exploit this state to access data.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.