CVE Vulnerability Catalog

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer. An attacker can supply a crafted DTS stream with a core_size larger than the actual packet length, causing unauthorized memory reads.

A double-free vulnerability in the NVIDIA NVDEC hardware decoder in FFmpeg versions 4.4 through 8.1.2. Attackers can trigger memory corruption by supplying a crafted video file, causing a double-free of the decoder context.

Duplicati v2.3.0.1 grants Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing outside Program Files or on a custom path creates a LocalSystem service running from a writable directory. A standard local user can overwrite any DLL in the service directory, leading to arbitrary code execution as SYSTEM on service restart.

Onlook up to version 0.2.32 contains a Broken Object Level Authorization (BOLA) vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values in tRPC API procedures. Attackers can read, modify, and delete other users' projects, members, and conversation history.

In FFmpeg versions 8.0 through 8.1.2, a stack buffer overflow vulnerability exists in the Vulkan HEVC hardware decoder. A remote attacker can supply a crafted HEVC/H.265 bitstream with a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS, causing overflow of stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability in the VobSub subtitle demuxer. Supplying a malicious .sub/.idx file with excessive stream IDs can cause out-of-bounds writes and potential code execution.

Vulnerability in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) in the IAM component generates incorrect security tokens. A low-privileged remote attacker can escalate privileges.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability. A high privileged attacker with remote access could exploit this to achieve privilege escalation.

In Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00, a vulnerability allows local privilege escalation to root for an already authenticated user on GNU/Linux or Oracle Solaris.

libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Analog Way Picturall Quad Compact Mark II version 3.5.8 contains a local privilege escalation vulnerability in the core firmware due to improper privilege delegation and insufficient input validation in a maintenance script.

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.

BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.

BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.

In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).

A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.

Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.

BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.

Vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

Vulnerability in NLnet Labs Unbound (versions 1.23.0 to 1.25.1) with 'dns-error-reporting: yes' enabled allows an attacker to remotely crash the daemon by sending a crafted upstream response. The bug occurs when processing the EDNS Report-Channel option.