CVE Feed

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.

Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.

The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.

An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.

This candidate is unused by its CNA.