CVE Vulnerability Catalog

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).

Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.

NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.

LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. Third parties dispute this because the LLVM security policy excludes language front-ends for which a malicious input file can cause undesirable behavior.

llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. This may lead to application crashes.

llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). This may lead to application crashes.

llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.". This may lead to application crashes.

An infinite loop vulnerability in tiftoimage that results in a heap buffer overflow in convert_32s_C1P1 was found in OpenJPEG 2.1.2.

An integer overflow vulnerability was found in the tiftoimage function in OpenJPEG 2.1.2, resulting in a heap buffer overflow.

A NULL pointer access occurs in the imagetopnm function of convert.c (jp2):1289 in OpenJPEG 2.1.2. Exploitation requires opening a crafted j2k file.

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr). This may lead to application crashes.

A flaw was found in the xdg-email component of xdg-utils 1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when passed to Thunderbird, potentially automatically attaching a victim's sensitive file.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp. This may lead to application crashes.

A vulnerability was found in LibTIFF up to 4.7.0. The function t2p_read_tiff_init of the file tools/tiff2pdf.c of the fax2ps component is affected. The manipulation leads to a null pointer dereference, and the attack requires local access.

A vulnerability was found in the Skia component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.

NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash).

A vulnerability in the libtiff library related to handling the SamplesPerPixel tag allows an attacker to cause a denial of service (DoS). Package updates are available for Amazon Linux 2023 that fix this issue.

An out-of-memory flaw was found in libtiff. Passing a crafted TIFF file to the TIFFOpen() API may allow a remote attacker to cause a denial of service via crafted input smaller than 379 KB.