CVE Vulnerability Catalog

Prior to versions 7.1.2-30 and 6.9.13-55 of ImageMagick, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

Prior to versions 6.9.13-56 and 7.1.2-31 of ImageMagick, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in versions 6.9.13-56 and 7.1.2-31.

Prior to version 7.1.2-32 of ImageMagick, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is fixed in version 7.1.2-32.

Prior to version 7.1.2-32 of ImageMagick, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, the delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable. This allows a local privileged workflow to overwrite a file with random data. The issue is fixed in version 7.1.2-32.

In ImageMagick prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop. This exhausts processing resources. The issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer. This causes the process to crash. The issue is fixed in version 7.1.2-32.

In praisonai-platform prior to 0.1.9, dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

A flaw was found in source-to-image where unpacking archive files fails to properly sanitize symbolic links pointing to absolute file paths. An attacker supplying a malicious builder image can embed links pointing outside the extraction directory. This bypasses sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).

A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw has been found in XnView Classic 2.52.5 in an unknown function of the FLI File Parser component. Manipulation of the starting_line argument causes a heap-based buffer overflow. Remote exploitation is possible. Upgrading to version 2.52.6 is recommended.

In Backstage prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in a deprecated Kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.

In Backstage prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

The @backstage/plugin-kubernetes-backend package prior to 0.21.9 allows an authenticated user with standard Kubernetes resource read permission to retrieve sensitive values that the plugin is designed to mask. This can expose credentials and other confidential material held in connected clusters, limited to resources the Backstage service account is permitted to read.

The @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to 0.3.25 is affected by improper input validation in the Confluence to Markdown scaffolder module. This could allow an attacker to influence file write operations during template execution if a Backstage user runs a template that processes attacker-influenced Confluence content.

A heap-based buffer overflow exists in GIMP's GIF export plug-in. Exporting an image with very large width and height can cause a 32-bit overflow when computing the pixel buffer size, leading to an integer overflow and a mismatch between allocation and actual write by GEGL.

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. The stun_init_error_response_common_str() function fails to zero-initialize the avalue buffer before computing its length and copying leaked stack bytes into the ERROR-CODE reason phrase.