CVE Vulnerability Catalog

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an OpenPixelCache call.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. This can lead to an application crash.

When a client is configured with a namespace, a request that hit a transient network error (timeout or connection closed by memcached or a proxy) was retried with the namespace applied a second time, so app:x became app:app:x.

The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. This vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.

In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference. This can lead to an application crash.

Per-request raw: true was ignored by some read methods, which still ran the configured serializer's load (Marshal by default) on values flagged as serialized — including get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata.

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.

@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object, and the function returns an object whose prototype is attacker-controlled.

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, potentially leaking sensitive visual information that was removed from the main JPEG image.

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. The vulnerability occurs only if the software is compiled in a certain way.

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an AcquireSemaphoreInfo call.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

Poppler 0.54.0 (as used in Evince and other products) has a NULL pointer dereference in JPXStream::readUByte in JPXStream.cc. Parsing an invalid PDF file causes a crash (segmentation fault).

In Xpdf prior to 4.04, the DCT (JPEG) decoder incorrectly allowed the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc. The flaw may be triggered when processing crafted PDF files.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.