CVE Vulnerability Catalog

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames, it calls free() on an uninitialized pointer, leading to a segmentation fault and potential denial of service.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when using the "-ImgDir" command line option on a directory containing 1048576 files.

In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.

In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.

A heap-buffer-overflow vulnerability was found in LibTIFF in the extractImageSection() function at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801, which can lead to denial of service via a crafted TIFF file.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, when using streams with a configured proxy and the request_fulluri option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to perform arbitrary HTTP requests through the proxy.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, the convert.quoted-printable-decode filter can cause a buffer overread by one byte, potentially leading to crashes or disclosure of other memory areas.

The net-tools package up to version 2.10 does not properly validate the structure of /proc files, which may lead to errors when reading data.

In libxslt before 1.1.43, numbers.c has a use-after-free because in nested XPath evaluations, an XPath context node can be modified but never restored. Affects xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.

The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

In libxml2 before 2.13.8 and 2.14.2, a heap-based buffer under-read exists in xmlSchemaIDCFillNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

In libxml2 before 2.13.8 and 2.14.2, out-of-bounds memory access occurs in the Python API due to an incorrect return value in xmlPythonFileRead and xmlPythonFileReadRaw.

In libxml2 before 2.12.10 and 2.13.6, a stack-based buffer overflow exists in xmlSnprintfElements in valid.c. Exploitation requires DTD validation of an untrusted document or untrusted DTD. Similar to CVE-2017-9047.

In libxml2 before 2.12.10 and 2.13.6, a use-after-free exists in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

In libxml2 before 2.11.0, xmlXIncludeAddNode in xinclude.c has a use-after-free vulnerability.