CVE Vulnerability Catalog

A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, potentially leaking sensitive visual information that was removed from the main JPEG image.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference. This can lead to an application crash.

In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. This can lead to an application crash.

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file. The vendor states this is a Q64 issue and Q64 is not supported.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object, and the function returns an object whose prototype is attacker-controlled.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

p_token and l_token were checked only for CR, LF and NUL. A token containing spaces added arbitrary meta flags to the command — e.g. changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or choosing incr's initial value.

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an OpenPixelCache call.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.