Ecosystem
Debian
61,809 known vulnerabilities.
Most affected packages
11,599 results · Clear filters · Feed
-
Medium 5.5
Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service
Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_…
-
Medium 6.9
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an…
-
Medium 5.9
Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a pat…
-
Medium 6.5
Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDV…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-boun…
-
Medium 6.3
Crass: Non-ASCII characters cause superlinear CPU consumption
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear p…
-
Medium 6.3
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An att…
-
Medium 6.3
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or …
-
Medium 6.5
Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an inv…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of p…
-
Medium 5.9
gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParame…
-
Medium 5.3
Stored XSS via crafted URLs in HTML ticket content in Request Tracker
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the vi…
-
Medium 6.1
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when brow…
-
Medium 5.5
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, w…
-
Medium 6.1
Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image Data
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or …
-
Medium 4.3
Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.
-
Medium 6.8
epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler…
-
Medium 4.8
tcpflow < 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length
tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pc…
-
Medium 6.1
AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a mu…
-
Medium 4.3
NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can t…
-
Medium 4.8
Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting ser…
-
Medium 5.4
phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML marku…
-
Medium 4.2
phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT an…
-
Medium 6.8
phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST…
-
Medium 4.3
phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON…
-
Medium 4.2
phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted datab…
-
Medium 5.5
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payloa…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operato…
-
Medium 5.3
ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE …
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands…
-
Medium 4.3
ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directo…
-
Medium 5.6
ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authent…
-
Medium 5.4
Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a f…
-
Medium 6.9
Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSO…
-
Medium 6.3
Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_inte…
-
Medium 6.5
Gcc: stack overflow in std::bitset on libstdc++
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an …
-
Medium 5.9
Gcc: integer wrap in `std
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the conta…