CVE Vulnerability Catalog

Nodemailer's address parser has three published, patched fixes for RFC 5322 comment handling inside an addr-spec. The description covers earlier issues with glued domain atoms and quoted local parts, plus related ReDoS fixes.

Nodemailer's SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether it is still a partial reply on every line. The partial-response test performs string operations per line, which can lead to inefficient processing.

net-ssh's transport packet reader trusts the 4-byte wire packet length without capping it against RFC 4253 §6.1 (35000 bytes). Pre-KEX (plaintext), a malicious server can declare an arbitrarily large packet length and stream data, causing unbounded client memory growth before authentication.

Net::SSH::Transport::ServerVersion#read! appends each received byte to @version until a newline, then copies to @header, with no maximum line length or total byte cap enforced. A malicious server sending a long identification line without LF causes unbounded memory growth.

When a crafted ed25519 private key containing an insane number of rounds is loaded, net-ssh enters an infinite CPU-time consuming loop for a very long time trying to load the key. The fact that the key is not a real SSH key does not matter in this regard.

Per-request raw: true was ignored by some read methods, which still ran the configured serializer's load (Marshal by default) on values flagged as serialized — including get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata.

When a client is configured with a namespace, a request that hit a transient network error (timeout or connection closed by memcached or a proxy) was retried with the namespace applied a second time, so app:x became app:app:x.

A vulnerability in the Sanitize library allows bypassing CSS sanitization when <style> elements are allowed, when Sanitize::CSS#stylesheet or Sanitize::CSS#tree! is used to sanitize a stylesheet directly, or when output from Sanitize::CSS#properties is embedded inside a style rule. An attacker can inject malicious CSS, potentially leading to dangerous actions in the user's browser.

A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.

The decNumberCopy function in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write. This can be demonstrated by using --slurp with subtraction, such as a filter of .-. when the input has a certain form.

p_token and l_token were checked only for CR, LF and NUL. A token containing spaces added arbitrary meta flags to the command — e.g. changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or choosing incr's initial value.

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. The vulnerability occurs only if the software is compiled in a certain way.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. This can lead to an application crash.

The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.

@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object, and the function returns an object whose prototype is attacker-controlled.

A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

The openTempFile function in Xpdf and Poppler 0.24.3 and earlier creates temporary files with predictable names when running on non-Unix systems. A local user can exploit a symlink attack to overwrite arbitrary files.