CVE Vulnerability Catalog

Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.

A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames, it calls free() on an uninitialized pointer, leading to a segmentation fault and potential denial of service.

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when using the "-ImgDir" command line option on a directory containing 1048576 files.

In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.

In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.

The go-ntlmssp package before version 0.1.1 contains a vulnerability that causes a slice out of bounds panic when processing a malicious NTLM challenge message. This can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

GNU Midnight Commander 4.8.29-146-g299d9a2fb was found to contain a NULL pointer dereference in the function x_error_handler() at tty/x11conn.c. NOTE: this is disputed because it should be categorized as a usability problem (an X operation silently fails).

A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.

In xmllint from libxml2 before versions 2.11.8 and 2.12.7, formatting error messages with --htmlout can cause a buffer over-read in xmlHTMLPrintFileContext.

A heap-buffer-overflow vulnerability was found in LibTIFF in the extractImageSection() function at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801, which can lead to denial of service via a crafted TIFF file.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.