Search: 16.5-2

A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

CVE-2026-113795 is a medium severity vulnerability affecting multiple versions of pypdf2, a pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack complexity. The vulnerability impacts various Ubuntu package versions of pypdf2. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.

Multiple vulnerabilities in PHP versions 5.5, 7.0, 7.2, and 7.4 were discovered affecting Ubuntu LTS releases. These vulnerabilities involve incorrect handling of out-of-memory conditions and improper management of internal request state across worker reuse, which could allow a remote attacker to execute arbitrary code. Ubuntu has released patches for these issues across supported LTS versions, including updates for older releases via Ubuntu Pro and Legacy Support add-ons.

A segmentation violation vulnerability exists in the check_media_profile function of the gpac software. This flaw can cause a crash when processing media profiles. The issue affects multiple specific versions of gpac. The vulnerability has a CVSS score of 5.5, indicating a medium severity impact primarily due to availability disruption.

A heap use-after-free vulnerability exists in the dasher_flush_segment function of gpac. This flaw can lead to a denial of service due to application crash. The issue affects multiple specific versions of gpac as listed. The vulnerability has a medium severity rating with a CVSS score of 5.5.

A heap use-after-free vulnerability exists in the gpac software within the gf_filter_pid_send_event_downstream function. This flaw can lead to a denial of service by causing application crashes. The vulnerability requires local access and user interaction to exploit and does not impact confidentiality or integrity.

A use-after-free vulnerability exists in the gpac software within the gf_filter_packet_destroy function. This flaw can lead to a denial of service due to application crash. The vulnerability has a medium severity rating with a CVSS score of 5.5. Multiple specific versions of gpac are affected. There is no information about available patches or active exploitation in the wild.

A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

A segmentation violation vulnerability exists in the GetESD function within the /isomedia/track.c file of the gpac software. This flaw can cause an application crash or denial of service when the affected function is triggered. The vulnerability has a medium severity rating with a CVSS score of 5.5. Multiple specific versions of gpac are affected. No public exploit code or known exploitation in the wild has been reported. No patch or remediation information is currently available.

A stack overflow vulnerability exists in the gf_bifs_dec_node function of the gpac software. This flaw can cause a denial of service by crashing the application. The vulnerability has a medium severity rating with a CVSS score of 5.5. Multiple specific versions of gpac are affected. No public exploits or patches are currently documented.

CVE-2025-71438 is an out-of-bounds read vulnerability in the gpac software, specifically in the function gf_odf_ac4_cfg_dsi_v1 within the /odf/descriptors.c file. This flaw can cause an application crash or denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.5. It affects multiple specific versions of gpac as listed. There is no information about available patches or fixes in the provided data.

A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.

CVE-2026-109619 is a high-severity vulnerability in PHP where internal request state can persist after its backing memory has been freed. This stale state may be used by a later request handled by the same worker before it is properly reinitialized, potentially allowing remote code execution. The issue affects multiple PHP versions across various Ubuntu releases. Official patches are available and should be applied to mitigate the risk.

A high severity vulnerability (CVE-2026-19630) affecting specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to availability, with no confidentiality or integrity impact reported. Multiple specific Ubuntu package versions of Bind9 are affected.

CVE-2026-97313 is a reachable assertion vulnerability in ISC BIND 9 that can cause the server to exit unexpectedly, resulting in a denial of service. The issue occurs when a recursive BIND server receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0), under specific configuration conditions involving RPZ zones. This affects BIND 9 versions from 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and certain S1 builds. The vulnerability requires the server to allow recursive queries and have at least two RPZ zones configured with differing "recursive-only" settings.

CVE-2026-96888 is a high-severity vulnerability in ISC BIND 9 affecting versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and their respective S1 variants. The issue occurs when a BIND resolver is configured with both a "redirect" zone and "qname-minimization strict" enabled, leading to an assertion failure and abort due to a NULL pointer dereference during redirect processing.