Threat database

PyMuPDF versions before 2.0, including several specific builds, contain a stack-based buffer overflow vulnerability in the JM_set_annot_callout_line() function. This flaw arises because the function copies a caller-supplied number of callout points into a fixed-size three-element stack array without proper bounds checking. An attacker controlling the callout argument to Page.add_freetext_annot() can supply four or more points, leading to stack frame overwrite, which may cause a crash or enable code execution.

A vulnerability in hivex allows an attacker to cause an out-of-bounds memory read by supplying a specially crafted Windows registry hive file with malformed large data block lists. This can cause the application processing the file to crash, resulting in a denial of service. The issue affects multiple specific versions of hivex and has a low severity rating with a CVSS score of 2. No public exploits are known, and the vulnerability requires high privileges and user interaction to be exploited.

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.

HDF5 versions through 2.2.0 contain an uncontrolled recursion vulnerability in the H5B__iterate_helper() function. This flaw occurs when iterating a version 1 B-tree where a child node’s level is not properly verified, allowing crafted files with self-referential B-tree nodes to cause unbounded recursion. Triggering this vulnerability via certain API calls results in stack exhaustion and application crashes, leading to denial of service.

psqlODBC versions before 18.00.0006 have a stack buffer overflow vulnerability in the handling of updatable cursors. The driver adds hidden ctid and oid columns to queries, copying values into a fixed 32-byte buffer without proper length checks. This can cause memory corruption if a value of 32 bytes or more is received from a server or crafted view. Builds with _FORTIFY_SOURCE abort on overflow; others may overwrite adjacent stack memory.

On Unix-like systems, psqlODBC creates log files in /tmp with default permissions that are typically world-readable. These log files are named using the program name, user name, and process ID, and the driver follows symbolic links when opening them. This allows a local user to read sensitive query text and data from another user's logs and to redirect log data to arbitrary files by placing symbolic links at predictable paths. Versions before psqlODBC 18.00.0006 are affected.

psqlODBC versions before 18.00.0006 have a vulnerability in handling updatable cursors over tables without OIDs that contain an auto-increment int4 column. The driver uses the column name in SQL statements without properly escaping double quotes, allowing a specially crafted column name containing double quotes to alter the executed SQL. This can lead to unauthorized modification of rows when the application uses positioned UPDATE or DELETE statements.

Several psqlODBC entry points improperly use application-supplied column numbers or row indexes as array indexes without validation, leading to out-of-bounds reads and writes. This affects versions before psqlODBC 18.00.0006. The vulnerability can cause memory corruption due to negative indexing and unchecked row numbers.

A vulnerability in psqlODBC before version 18.00.0006 allows a stack buffer overflow when quoting schema or table names longer than 128 bytes. This overflow can write up to two bytes past the buffer boundary, causing stack corruption. The issue arises from insufficient length checks when handling SQL text, including table names and rewritten SELECT @@IDENTITY statements. Applications forwarding untrusted SQL text to the driver may be exposed to this vulnerability.

The SQLSpecialColumns function in psqlODBC versions before 18.00.0006 improperly constructs its catalog query by inserting table and schema names without escaping them. This flaw allows an application that passes untrusted input to execute arbitrary SQL commands with the connection's privileges. Other catalog functions in psqlODBC correctly escape these inputs, making this issue specific to SQLSpecialColumns.

The psqlODBC driver contains a vulnerability in its parser for ODBC escape sequences where argument offsets for {fn} escapes are written into a fixed-size stack array without bounds checking, leading to stack overflow and memory corruption. Additionally, certain escape sequences ({d}, {t}, {ts}, {escape}) write one byte beyond a 128-byte stack buffer. Applications forwarding untrusted SQL text to this driver risk process memory corruption. Versions before psqlODBC 18.00.0006 are affected.

psqlODBC versions before 18.00.0006 contain multiple vulnerabilities related to trusting server-supplied counts and lengths. These include an underflow in SQLBulkOperations due to unvalidated row counts, unbounded iteration in SQLStatistics using server-supplied key counts, and out-of-bounds reads in bytea octal decoding. A server not trusted under current SSL settings can cause client crashes or out-of-bounds reads.

A vulnerability in psqlODBC versions before 18.00.0006 allows a specially crafted column name containing format directives to cause memory reading issues. This occurs when an updatable cursor over a table without OIDs and with an auto-increment int4 column is used. The driver improperly uses the column name in a printf-style format string, potentially leading to application crashes or unintended memory disclosure.

psqlODBC versions before 18.00.0006 have a vulnerability where the driver sizes its row cache based on the first result's column count but does not verify subsequent FETCH replies for column count consistency. This can lead to heap buffer overflow or underflow when a malicious or untrusted server sends a FETCH reply with a different number of columns. The issue is exploitable when UseDeclareFetch is enabled.

psqlODBC versions before 18.00.0006 contain a vulnerability where the client copies data from a large-object read (loread) into its buffer using the length provided by the server without verifying the buffer size. This can allow a malicious or untrusted server, or a man-in-the-middle, to overflow the client buffer and overwrite adjacent memory. Any fetch of a large-object column can trigger this issue. The vulnerability has a high severity rating with a CVSS score of 7.5.

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

Multiple vulnerabilities in python-pypdf can lead to denial of service conditions through memory exhaustion, infinite loops, and excessive resource consumption. These issues arise from improper handling of PDF structures such as negative /Index values, forged /Count values, nested exception text, repeated scanning in page_labels, misdirected reference tracking, unbounded resource copying, and unterminated trailer searches. The vulnerabilities collectively enable clamp bypass, memory amplification, algorithmic complexity attacks, and thread-hanging infinite loops.

This security update for libosmocore addresses multiple vulnerabilities including buffer overflows and overreads in various components such as bssgp_rx_paging, parse_process_uss_req, and others. It also fixes a stack buffer overflow in iuup when receiving payloads larger than 1024 bytes, and rejects malformed BSSMAP Encryption Information IE messages. The update includes several other fixes and improvements across releases 1.11.1 through 1.14.2.