CVE Vulnerability Catalog

The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. This vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an OpenPixelCache call.

In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. This can lead to an application crash.

When a client is configured with a namespace, a request that hit a transient network error (timeout or connection closed by memcached or a proxy) was retried with the namespace applied a second time, so app:x became app:app:x.

In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference. This can lead to an application crash.

ImageMagick prior to versions 6.9.13-27 and 7.1.2-1 has undefined behavior (function-type-mismatch) in the splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds).

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.

A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, potentially leaking sensitive visual information that was removed from the main JPEG image.

The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file. The vendor states this is a Q64 issue and Q64 is not supported.

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. The vulnerability occurs only if the software is compiled in a certain way.

A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an AcquireSemaphoreInfo call.

The openTempFile function in Xpdf and Poppler 0.24.3 and earlier creates temporary files with predictable names when running on non-Unix systems. A local user can exploit a symlink attack to overwrite arbitrary files.

Multiple unspecified vulnerabilities in GraphicsMagick before 1.2.4 allow remote attackers to cause a denial of service (crash, infinite loop, or memory consumption) via unspecified vectors in the AVI, AVS, DCM, EPT, FITS, MTV, PALM, RLA, and TGA decoders.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.

In the Linux kernel, in the RDMA/hns driver, a soft lockup issue under heavy CEQE load was fixed by moving CEQE handling to the BH (bottom half) context.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.