CVE Vulnerability Catalog

Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.

A vulnerability in the Go net/http library allows a malicious HTTP sender to use chunk extensions to force a receiver to read many more bytes from the network than are in the body. A malicious HTTP client can exploit this to cause a server to automatically read a large amount of data (up to about 1 GiB).

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

It was discovered that a systemd service using the DynamicUser property can gain new privileges through the execution of SUID binaries, allowing creation of binaries owned by the service's transient group with the setgid bit set. A local attacker may exploit this flaw to access resources that will be.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc due to a misplaced isOk check.

The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.

A vulnerability in the Go standard library (net/http) causes the HTTP client to not forward sensitive headers like Authorization or Cookie when following a redirect to a domain that is not a subdomain or exact match of the original domain. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to a different domain will not.

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause application crashes when handling malformed inputs associated with INT_MIN.

An out-of-bounds read vulnerability exists in libpoppler.so in Poppler through version 24.12.0 within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

A heap buffer overflow flaw was found in the OpenJPEG project. It can be triggered when using the opj_decompress utility with certain options, leading to application crash or undefined behavior.

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.

A vulnerability in the Go standard parser causes a panic when processing source code with deeply nested literals. The issue stems from stack exhaustion during recursive parsing.

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.