Netty versions prior to 4.1.137.Final and 4.2.17.Final contain a vulnerability in the MqttEncoder component where client identifiers, will topics, usernames, and PUBLISH topic names are not validated before encoding. This allows prohibited null bytes in MQTT UTF-8 string fields, potentially causing routing, access-control, or identity mismatches in downstream brokers. The issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
A vulnerability in the file-pix (ESM) plugin of GIMP allows a specially crafted PIX image file to trigger an unbounded stack allocation and a 21-byte stack over-read. This flaw can cause denial of service due to stack exhaustion and limited disclosure of stack memory contents. The issue affects multiple specific versions of GIMP. The CVSS score is 6.1, indicating a medium severity level.
A heap-based buffer overflow vulnerability exists in the file-pcx plugin of GIMP affecting 32-bit builds. The flaw arises from an integer overflow during memory allocation size calculation when processing crafted PCX image files with 4 color planes and large dimensions. This results in undersized heap allocation and subsequent memory corruption, potentially leading to arbitrary code execution or denial of service. The issue affects multiple specific GIMP versions listed, primarily on Ubuntu builds. The CVSS score is 7.0, indicating a medium severity level.
A vulnerability in RPM's rpmbuild tarball processing allows arbitrary code execution when processing a crafted source archive. The issue arises from the getTarSpec() function passing an attacker-controlled tar archive member name to rpmExpand() within a macro expression, enabling macro and Lua expression injection. Exploitation requires processing a malicious tarball with rpmbuild in tarball mode.
fast-uri, a URI parser for Node.js, has a vulnerability in versions 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue involves improper handling of percent-encoded slashes in the scheme component, leading to incorrect parsing and potential off-site redirects, server-side request forgery, or address-policy bypass. The flaw is fixed in versions 2.4.5, 3.1.6, and 4.1.3 by rejecting invalid schemes after decoding. Users should upgrade to these patched versions.
fast-uri, a URI parser for Node.js used in node-ajv, inconsistently canonicalizes hosts depending on whether the URI includes an explicit scheme. This inconsistency can cause host confusion, allowing policy bypass when applications compare hosts extracted by different fast-uri functions. The vulnerability affects versions 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. Fixed versions 2.4.5, 3.1.6, and 4.1.3 address the issue by consistent host canonicalization. Users should upgrade to these patched versions to mitigate the risk.
fast-uri, a URI parser for Node.js, has a vulnerability in its custom parser for bracketed IPv6 literals that fails to fully validate IPv6 grammar. This allows malformed IPv6 addresses with invalid trailing characters to be normalized to valid but unintended addresses such as the unspecified address or private-range addresses. As a result, applications that normalize untrusted URLs before making outbound requests or routing can be tricked into redirecting to local or private IPv6 targets, enabling server-side request forgery and bypassing address-policy enforcement. The vulnerability affects versions 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
A vulnerability in ONNX versions prior to 1.21.0 allows a local attacker with write access to a directory to exploit a race condition in the 'save_external_data' function. This function constructs the external data file path from the model's external_data location field and opens it without secure flags after a non-atomic check, enabling symlink attacks. An attacker can cause the victim process to append data to arbitrary files such as ~/.ssh/authorized_keys or cron files. The issue is fixed in ONNX version 1.21.0.
Incus versions prior to 7.3.0 contain a critical vulnerability allowing an unprivileged, project-confined user with specific permissions to execute arbitrary code as root on the host. This occurs because a crafted image can include a backup.yaml file as a symlink to an arbitrary host file, which the root daemon follows when writing backup files. The issue is patched in version 7.3.0.
Incus versions prior to 7.3.0 contain a vulnerability where a malicious image with a metadata.yaml symlink can allow an authenticated user to read or overwrite any host file as root via the instance metadata API. Previous patches addressed similar issues with other paths but did not cover metadata.yaml. Version 7.3.0 includes a fix for this vulnerability.
Coturn versions prior to 4.15.0 contain a vulnerability where an unauthenticated remote client can send a specially crafted STUN message over TCP or TLS with a body-length field between 65520 and 65532. This causes an integer wrap in the message length calculation, leading to stream parser desynchronization and dropping the attacking client's connection. Other clients and the server process remain unaffected. The issue is fixed in version 4.15.0.
Coturn versions prior to 4.13.0 contain a vulnerability where an authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute. This input passes validation and is used unsafely in Redis commands, leading to potential process crashes or disclosure of stack memory. The issue is fixed in version 4.13.0.
Coturn versions prior to 4.15.0 have a vulnerability where an on-path attacker can append attributes after the MESSAGE-INTEGRITY attribute in an authenticated STUN request over plain UDP or TCP. This allows modification of the STUN header length and recomputation of the unkeyed FINGERPRINT while the original HMAC remains valid. As a result, server-side parsing continues past MESSAGE-INTEGRITY, enabling the attacker to override allocation lifetime, inject permissions, or bypass origin checks. Deployments using TLS or DTLS are not affected by this issue. The vulnerability is fixed in Coturn version 4.15.0.
Coturn version 4.15.0 contains a vulnerability where an authenticated TURN user can repeatedly resume a single allocation from new UDP 5-tuples without completing a handoff when the server's --mobility option is enabled. This flaw allows the attacker to retain unbounded server-side sessions, potentially exhausting process memory even if user quotas are configured. The issue is resolved in version 4.16.0.
Deskflow versions from 1.17.0 up to continuous build 1.26.0.296 contain a vulnerability where a malicious Deskflow server can send a malformed DSOP vector causing a client crash. This is due to reading beyond the vector boundary during handshake message parsing. The issue is fixed starting with continuous build 1.26.0.296.
Deskflow, a keyboard and mouse sharing application, contains a vulnerability in versions prior to continuous build 1.26.0.299. A remote unauthenticated Deskflow server can send crafted kMsgDSetOptions (DSOP) values that cause out-of-bounds indexing in internal translation tables, potentially disclosing four bytes of memory or crashing the connected client. An odd option count can also cause an out-of-bounds read in the OptionsList. This issue is fixed in continuous build 1.26.0.299.
Deskflow versions from 1.17.0 up to but not including continuous build 1.26.0.300 contain a vulnerability where a connected peer can send repeated clipboard data messages that cause memory exhaustion on the server or client. This occurs because data is appended beyond the declared size and clipboard limit before validation. The issue is fixed starting with continuous build 1.26.0.300.
Netatalk versions 3.1.19 through 4.4.2 contain a stack-based buffer overflow vulnerability in the deletedir() function of the afpd daemon. This occurs due to an integer underflow in the calculation of the remaining buffer size, which leads to an unbounded strcpy() operation copying attacker-controlled filenames into a stack buffer. The vulnerability is patched in version 4.4.3.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability where responses from the CSS proxy are not validated. This flaw may lead to information disclosure or cross-site scripting (XSS) attacks via MIME sniffing.
Capstone's WebAssembly backend prior to version 6.0.0-Alpha9 improperly handles large br_table instructions in the cs_disasm() and cs_disasm_iter() APIs, causing instruction size wrapping and parser integrity issues. This can lead to repeated decoding of the same instruction or misinterpretation of instruction bytes, affecting availability and parser correctness. The issue is patched in version 6.0.0-Alpha9.