CVE Vulnerability Catalog

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.

The go-ntlmssp package before version 0.1.1 contains a vulnerability that causes a slice out of bounds panic when processing a malicious NTLM challenge message. This can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport.

GNU Midnight Commander 4.8.29-146-g299d9a2fb was found to contain a NULL pointer dereference in the function x_error_handler() at tty/x11conn.c. NOTE: this is disputed because it should be categorized as a usability problem (an X operation silently fails).

A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.

There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as <use>. This is related to GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors.

SSH clients that receive SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Vulnerability in Tar 1.15.1 fails to properly warn users when extracting files with setuid or setgid bits set. This could allow local or remote attackers to escalate privileges.

Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.

Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.

An issue was discovered in py-lmdb 0.97 where mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.

The GD Graphics Library (LibGD) through version 2.3.2 has an out-of-bounds read due to the lack of certain gdGetBuf and gdPutBuf return value checks.

An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow, leading to a heap-based buffer overflow when processing sector allocation.

A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.

Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.

A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.