Threats tagged 'bitnami'

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.

A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

A vulnerability in Sparkle before version 2.6.4 allows an attacker to bypass (Ed)DSA signing checks by replacing a signed update with a malicious payload. This affects certain versions of the Java Runtime Environment (JRE) as specified. A patch is available to address this issue.

An out-of-bounds read vulnerability exists in GStreamer's gst_wavparse_adtl_chunk function due to improper validation of a size parameter. This flaw can cause the process to read up to 4GB beyond the intended buffer or trigger a segmentation fault. The issue affects certain versions of the GStreamer library and has been fixed in version 1.24.10.

An out-of-bounds read vulnerability exists in the gst_wavparse_smpl_chunk function of the GStreamer library. The function reads 4 bytes from an offset without verifying the buffer size, potentially reading beyond the data boundary. This issue is fixed in version 1.24.10.

An out-of-bounds read vulnerability exists in GStreamer's gst_wavparse_cue_chunk function due to a miscalculation of chunk size, allowing reading beyond the data buffer. This can cause crashes or sensitive data leaks. The issue is fixed in version 1.24.10.

An out-of-bounds read vulnerability exists in the parse_ds64 function of GStreamer's gstwavparse.c. The function fails to verify buffer length before reading, which can cause reading beyond the buffer boundary. This may lead to application crashes or sensitive data leakage. The issue is fixed in version 1.24.10.

An integer underflow vulnerability exists in GStreamer's MP4/MOV demuxer (qtdemux) that leads to an out-of-bounds memory write. This occurs due to improper handling of a size variable, resulting in a buffer allocation smaller than intended and subsequent memory corruption. The corrupted memory can overwrite function pointers, potentially allowing an attacker to hijack execution flow and achieve arbitrary code execution. The issue is fixed in GStreamer versions 1.8.0 and 8.0.451 and later.

An out-of-bounds read vulnerability exists in GStreamer's qtdemux_parse_samples function, which can read up to 8 bytes beyond the intended buffer boundary. This issue affects certain versions of the GStreamer library and has been fixed in version 1.24.10.

An out-of-bounds read vulnerability exists in GStreamer's qtdemux component when parsing FOURCC_SMI_ data. The issue arises from improper validation of seqh_size, which can cause reading beyond the buffer limits, potentially exposing up to 4GB of process memory or causing a segmentation fault. This vulnerability is fixed in version 1.24.10.