CVE Vulnerability Catalog

Nodemailer resolves an international (IDN / non-ASCII) recipient domain to a different Punycode label than every UTS-46-conformant parser (web browsers, WHATWG URL Standard, Node's url.domainToASCII, Python's idna). Its address normalizer (_normalizeAddress) may lead to incorrect domain resolution, enabling phishing or message misdirection.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).

A vulnerability in the libtiff library related to handling the SamplesPerPixel tag allows an attacker to cause a denial of service (DoS). Package updates are available for Amazon Linux 2023 that fix this issue.

A vulnerability was found in the Skia component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp. This may lead to application crashes.

llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand. This may lead to application crashes.

A vulnerability was found in LibTIFF up to 4.7.0. The function t2p_read_tiff_init of the file tools/tiff2pdf.c of the fax2ps component is affected. The manipulation leads to a null pointer dereference, and the attack requires local access.

A vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Affected versions are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. An easily exploitable vulnerability allows a low privileged attacker with network access via multiple protocols to compromise MySQL.

A flaw was found in the xdg-email component of xdg-utils 1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when passed to Thunderbird, potentially automatically attaching a victim's sensitive file.

A NULL pointer access occurs in the imagetopnm function of convert.c (jp2):1289 in OpenJPEG 2.1.2. Exploitation requires opening a crafted j2k file.

An integer overflow vulnerability was found in the tiftoimage function in OpenJPEG 2.1.2, resulting in a heap buffer overflow.

An infinite loop vulnerability in tiftoimage that results in a heap buffer overflow in convert_32s_C1P1 was found in OpenJPEG 2.1.2.

LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).

The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction.

ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).