4 results · Feed
-
Medium 6.1
GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count no…
-
Unscored —
There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c…
-
Unscored —
There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A cr…
-
Unscored —
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input w…