Docker circleci/node:12.8-browsers

Overview

In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.

References

• ADVISORY
• CONFIRM
• Debian Security Tracker
• Gentoo Security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• REDHAT
• RHSA Security Advisory
• Security Focus

Overview

The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution.

References

• Debian Security Tracker
• Gentoo Security Advisory
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21990

Overview

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

References

• CONFIRM
• Debian Security Tracker
• Exploit DB
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker

Overview

The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.

References

• ADVISORY
• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• REDHAT
• RHSA Security Advisory
• Security Focus
• Ubuntu CVE Tracker

Overview

In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in malloc() with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

References

• ADVISORY
• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker

Overview

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

References

• Debian Security Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=22148

Overview

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

References

• CONFIRM
• Debian Security Tracker
• MISC
• REDHAT
• Security Focus

Overview

The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.

References

• Debian Security Tracker
• Security Focus
• Ubuntu CVE Tracker
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0c54f69295208331faab9bc5e995111a35672f9b

Overview

The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

References

• Debian Security Tracker
• Gentoo Security Advisory
• Security Focus
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21933

Overview

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

References

• Debian Security Tracker
• https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/
• https://sourceware.org/bugzilla/show_bug.cgi?id=22170
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=56933f9e3e90eebf1018ed7417d6c1184b91db6b
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360

Overview

The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21786

Overview

The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.

References

• Debian Security Tracker
• Gentoo Security Advisory
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21787

Overview

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

References

• BUGTRAQ
• BUGTRAQ
• CONFIRM
• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• FREEBSD
• MISC
• MISC
• MISC
• MISC
• MLIST
• MLIST
• MLIST
• MLIST
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code.

References

• Debian Security Tracker
• MISC
• Ubuntu CVE Tracker

Overview

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code.

References

• Debian Security Tracker
• MISC
• Ubuntu CVE Tracker

Overview

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.

References

• Debian Security Tracker
• MISC
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Arbitrary Code Injection curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• ADVISORY
• MISC
• MISC

Overview

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

References

• ADVISORY
• BUGTRAQ
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MISC
• N/A
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

References

• ADVISORY
• BUGTRAQ
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MISC
• N/A
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MLIST

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MLIST

Overview

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

References

• BUGTRAQ
• CONFIRM
• CONFIRM
• CONFIRM
• CVE Details
• DEBIAN
• Debian Security Tracker
• Fedora Security Update
• GENTOO
• MISC
• MISC
• MLIST
• N/A
• Netapp Security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Use After Free. Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• GENTOO
• MISC
• MISC

Overview

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

References

• ADVISORY
• Bugtraq Mailing List
• CONFIRM
• CONFIRM
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• FULLDISC
• FULLDISC
• GitHub Issue
• MISC
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.

References

• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• MISC
• MISC
• SUSE
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

References

• ADVISORY
• Bugtraq Mailing List
• Cert Vulnerability Note
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• MISC
• MISC
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.

References

• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• UBUNTU

Overview

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

References

• ADVISORY
• BUGTRAQ
• BUGTRAQ
• BUGTRAQ
• BUGTRAQ
• BUGTRAQ
• BUGTRAQ
• BUGTRAQ
• Bugtraq Mailing List
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• DEBIAN
• DEBIAN
• Debian Security Tracker
• FEDORA
• FEDORA
• FEDORA
• FULLDISC
• FULLDISC
• FULLDISC
• FULLDISC
• GENTOO
• GitHub Commit
• GitHub Issue
• GitHub Issue
• GitHub PR
• MISC
• MISC
• MISC
• MISC
• MLIST
• MLIST
• N/A
• REDHAT
• REDHAT
• REDHAT
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

References

• ADVISORY
• CONFIRM
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• GENTOO
• GitHub Commit
• MISC
• SUSE
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

References

• CONFIRM
• Debian Security Tracker
• MISC

Overview

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

References

• Debian Security Tracker
• GitHub Issue
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

References

• Debian Security Tracker
• GitHub Issue
• Security Focus
• Ubuntu CVE Tracker

Overview

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

References

• ADVISORY
• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• MISC
• OpenSuse Security Announcement
• SUSE
• Ubuntu CVE Tracker

Overview

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

References

• ADVISORY
• Debian Security Tracker
• GENTOO
• MISC
• MISC
• OpenSuse Security Announcement
• RHSA Security Advisory
• SUSE
• Ubuntu CVE Tracker

Overview

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

References

• ADVISORY
• Debian Security Tracker
• GENTOO
• MISC
• MISC
• OpenSuse Security Announcement
• RHSA Security Advisory
• SUSE
• Ubuntu CVE Tracker

Overview

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

References

• ADVISORY
• CONFIRM
• Debian Security Tracker
• Fedora Security Update
• GENTOO
• GENTOO
• MISC
• MLIST
• REDHAT
• REDHAT
• RHSA Security Advisory
• RHSA Security Advisory
• SUSE
• SUSE
• Ubuntu CVE Tracker

Overview

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

References

• Apple Security Advisory
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• GitHub Advisory
• GitHub Commit
• MISC
• MISC
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where some credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching any URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

References

• CONFIRM
• Debian Security Announcement
• Debian Security Tracker
• FULLDISC
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• GitHub Advisory
• GitHub Advisory
• GitHub Commit
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

References

• Debian Bug Report
• Debian Security Announcement
• Debian Security Announcement
• Debian Security Tracker
• MISC
• MISC
• MISC
• Netapp Security Advisory
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().

References

• Debian Security Announcement
• Debian Security Tracker
• MISC
• MISC
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• Fedora Security Update
• MISC
• Netapp Security Advisory
• REDHAT
• SUSE
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• Netapp Security Advisory
• Ubuntu CVE Tracker

Overview

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• GENTOO
• MISC
• MISC
• MISC
• MISC
• Netapp Security Advisory
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

References

• CONFIRM
• Debian Bug Report
• Debian Security Tracker
• Netapp Security Advisory
• Oracle Security Advisory
• REDHAT
• RHSA Security Advisory
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

References

• Debian Security Tracker
• Exploit DB
• Exploit DB
• MISC
• Netapp Security Advisory
• Oss-Sec Mailing List
• RHSA Security Advisory
• Security Focus
• Security Tracker
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• Netapp Security Advisory

Overview

An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

References

• ADVISORY
• Debian Security Tracker
• GENTOO
• MISC
• Netapp Security Advisory
• RedHat Bugzilla Bug
• UBUNTU

Overview

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• Netapp Security Advisory
• RedHat Bugzilla Bug
• UBUNTU
• Ubuntu CVE Tracker

Overview

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

References

• Debian Security Tracker
• MISC
• MISC
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

References

• CONFIRM
• CONFIRM
• CVE Details
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• MISC
• OpenSuse Security Announcement
• REDHAT
• RedHat Bugzilla Bug
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GitHub Commit
• GitHub Issue
• Ubuntu CVE Tracker

Overview

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

References

• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• GitHub Commit
• GitHub PR
• MISC
• MISC
• MISC
• MISC
• MISC
• RHSA Security Advisory
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.

References

• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file.

References

• CVE Details
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.

References

• DEBIAN
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.

References

• DEBIAN
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.

References

• DEBIAN
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-69.

Remediation

There is no fixed version for imagemagick.

References

• ADVISORY
• MISC

Overview

In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to CacheOpenCLKernel.

References

• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs because a memory allocation result is not checked, related to GetOpenCLCacheDirectory.

References

• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

References

• Debian Security Tracker
• GitHub Commit
• MLIST
• OpenSuse Security Announcement
• RedHat Bugzilla Bug
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."

References

• Debian Security Announcement
• Debian Security Tracker
• Gentoo Security Advisory
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read.

References

• CVE Details
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.

References

• CVE Details
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.

References

• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.

Remediation

Upgrade imagemagick to version or higher.

References

• ADVISORY
• MISC
• MLIST

Overview

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.

References

• CVE Details
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.

References

• CVE Details
• DEBIAN
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.

References

• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.

References

• ADVISORY
• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Issue
• SUSE
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.

References

• CONFIRM
• CONFIRM
• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to XML Injection. ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

Remediation

Upgrade imagemagick to version or higher.

References

• ADVISORY
• MISC
• MISC
• MLIST

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion. MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Remediation

Upgrade krb5 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• DEBIAN
• FEDORA
• FEDORA
• FEDORA
• GENTOO
• MLIST

Overview

nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).

References

• Debian Security Tracker
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC