Search: 7.3.1.1

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module. This flaw allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The vulnerability affects Stage File Proxy versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. Fixed versions are 3.1.7 and 4.0.1.

ImageMagick versions before 7.1.2-34 contain a stack overflow vulnerability in the TIFF decoder that can be triggered when the DNG decoder is disabled. An attacker can supply a crafted image file to cause a stack overflow, resulting in application crash and denial of service.

ImageMagick versions prior to 7.1.2-34 contain a heap-based buffer overflow vulnerability in the -morph processing feature. This flaw allows crafted images to cause writes beyond the bounds of a heap buffer, potentially crashing the application when processed with the -morph option.

Multiple security issues affecting the ImageMagick package version 7.1.2.34-3.1 on openSUSE Tumbleweed GA media have been fixed. These vulnerabilities are addressed in this specific package release by the SUSE Product Security Team. No detailed technical information or CVSS score is provided.

The ReadWriteLock and AsyncReadWriteLock classes in mlx-lm versions 0.30.7 through 0.32.0 resolve lock file paths following symlinks and pass them to sqlite3.connect() without preventing symlink traversal. This allows a local attacker with write access to the lock directory to cause the victim process to create or lock files at attacker-chosen locations, potentially breaking mutual exclusion and corrupting protected resources.

The msgpack-python C extension has a memory leak vulnerability triggered when deserialization rejects a map key under strict_map_key validation. This leak causes unbounded memory growth and potential denial of service when processing attacker-controlled MessagePack data. Additionally, the streaming Unpacker API may suffer from use-after-free or double free errors due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.46.7. The pure-Python fallback does not exhibit this leak. Exploitation does not impact confidentiality or integrity but can cause denial of service via resource exhaustion.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to inject arbitrary file read commands. This occurs because the branch name positional argument is not properly sanitized before being passed to the underlying git checkout command, allowing an attacker to read sensitive files such as /etc/passwd. The issue arises from an incomplete fix of previous advisories, where only keyword arguments were guarded but not positional arguments. The vulnerability has a CVSS 3.1 score of 7.5 (High).

Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT signature verification using HS256, HS384, and HS512 algorithms. This allows an attacker to forge tokens with arbitrary claims that pass signature verification if the application verifies tokens with an empty key. The vulnerability arises because empty keys produce deterministic, publicly reproducible HMAC digests, and no check rejects zero-length keys in the affected versions.

Authlib versions from 0.13 through 1.7.2 contain a vulnerability in the is_secure_transport() function, which incorrectly treats certain HTTP URLs with a userinfo component as secure loopback addresses. This allows an attacker to bypass the TLS enforcement by crafting URLs like http://localhost:80@evil.example/cb, which are accepted as secure despite being cleartext HTTP to an external host. The flaw affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing cleartext non-loopback URLs to be accepted where TLS is required. The severity is low, and a fix is available in version 1.50.0.

A vulnerability in filelock's ReadWriteLock and AsyncReadWriteLock components allows a local user with write permissions to the directory containing the SQLite lock database to manipulate symlinks or journal files. This manipulation can cause the lock user’s SQLite-backed lock to write arbitrary data into their own files, create or unlink files, or cause lock acquisition failures. The issue affects filelock versions from 3.20.4 through 4.2.0, with the fixed version being 1.79.0_1. The vulnerability requires a writable directory without the sticky bit, such as a 0777 or group-writable directory, and is limited to local users on the same host. The CVSS 3.1 score is 7.1 (High), reflecting high integrity and availability impacts but no confidentiality impact.

A vulnerability in the filelock library versions 3.22.0 through 4.2.0 allows a local user with write access to a lock marker file (but not removal rights) to forge the process ID in the marker. This causes another process running as the lock owner or root to mistakenly consider the lock stale, remove the live marker, and acquire the lock concurrently, leading to two processes running the critical section simultaneously without error. The issue arises when the marker file is created with group or other write permissions under certain umask settings or explicit modes. The vulnerability has a CVSS score of 4.7 (Medium) and impacts integrity but not confidentiality or availability.

GitPython contains vulnerabilities in three wrapper methods (`ls_remote`, `merge_base`, and `IndexFile.move`) that omit checks for unsafe protocols and options. The `ls_remote` method does not check the URL for unsafe protocols, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' protocol. The `merge_base` and `move` methods forward caller-controlled arguments without proper guards, creating latent argument-injection risks. These issues are verified unfixed on the main branch as of 2026-09-21 and affect versions from 1.0.616 up to but not including 3.3.30. A fix is available in version 3.3.30. The CVSS score is 7.5 (high severity).