CVE Vulnerability Catalog

Tor before 0.4.9.9 can enter an infinite loop when decompressing a truncated zlib/gzip stream with done=1. The truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR, which is mistaken for a full output buffer.

libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.

In lin-snow Ech0 up to 5.4.1, a vulnerability exists in the MD5Encrypt function in internal/util/crypto/crypto.go. The use of a risky cryptographic algorithm can be exploited remotely, though the attack complexity is rather high.

A vulnerability in Lighthouse allows a remote attacker, after compromising a spoke cluster, to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces. This occurs because the destination namespace is derived from an attacker-controlled label or annotation on the broker object.

A vulnerability in Submariner allows a malicious cluster (spoke) to redirect network traffic from other connected clusters by publishing a specially crafted network endpoint. The system fails to properly validate network subnets, enabling the malicious cluster to declare arbitrary network ranges.

SecureDrop Client before 1.3.1 can be tricked by a malicious SecureDrop Server responding with cross-origin redirects, bypassing securedrop-proxy's origin limitation.

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.

A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.

A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE option is enabled. This can lead to unauthorized file access and disclosure of filesystem structure. The product is no longer actively supported and the vulnerability has not been fixed.

An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. Details of affected products and versions are available in the vendor's information.

The GutenKit WordPress plugin before version 2.5.0 lacks sufficient capability checks on some REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.