Threats tagged 'bitnami'

An integer underflow vulnerability exists in the extract_cc_from_data function within the qtdemux.c file of the GStreamer library. Specifically, when processing the FOURCC_c708 case, a subtraction operation atom_length - 8 can underflow if atom_length is less than 8, causing an out-of-bounds read via g_memdup2. This vulnerability is fixed in version 1.24.10.

GStreamer, a media-handling library, contains an integer underflow vulnerability in the qtdemux_parse_trak function within qtdemux.c. The flaw occurs during FOURCC strf parsing, where a subtraction operation can cause a negative integer underflow if the size is less than 40. This leads to an out-of-bounds read when memcpy is called with an incorrect size. The vulnerability is fixed in version 1.24.10.

A null pointer dereference vulnerability exists in the GStreamer library's MP4/MOV demuxer CENC handling, specifically in the function qtdemux_parse_sbgp. This vulnerability can cause application crashes or denial of service. It affects certain versions of the library and is fixed in version 1.24.10.

RedisBloom versions prior to 2.8.20 contain a vulnerability in the RESTORE command handling that allows an authenticated attacker with RESTORE permission to supply crafted serialized payloads. This can cause invalid memory access and potentially lead to remote code execution. The issue is fixed in RedisBloom version 2.8.20. A workaround is to restrict RESTORE command access using ACL rules.

RedisTimeSeries versions prior to 1.12.14 contain a vulnerability in the RESTORE command handling that allows an authenticated attacker with RESTORE permission to supply a crafted serialized payload. This triggers invalid memory access and may lead to remote code execution. The issue is patched in version 1.12.14. A workaround is to restrict RESTORE command access via ACL rules.

A denial of service vulnerability exists in libModSecurity3 versions prior to 3.0.15. The flaw causes a segmentation fault when a rule using the t:hexDecode transformation processes a single-character query string parameter. This results in crashing worker processes and temporarily disrupting service until recovery. The issue has been fixed in version 3.0.15.

This update for apache2 fixes the following issues - CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957). - CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935). - CVE-2026-28780: heap buffer overflow in `mod_proxy_ajp` via `ajp_msg_check_header()` (bsc#1264163). - CVE-2026-29168: allocation of resources without limits in `mod_md` via OCSP response (bsc#1264150). - CVE-2026-29169: NULL pointer dereference in `mod_dav_lock` allows server crash via malicious requests (bsc#1263956). - CVE-2026-33006: `mod_auth_digest` timing attack allows bypass of Digest authentication (bsc#1263955). - CVE-2026-33007: NULL pointer dereference in `mod_authn_socache` allows unauthenticated remote user to crash a child processes (bsc#1263954). - CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953). - CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952). - CVE-2026-34032: heap buffer overread in `mod_proxy_ajp` due to missing null-termination check (bsc#1263951). - CVE-2026-34059: heap buffer overread and memory disclosure via `ajp_parse_data()` (bsc#1263950).

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

This update for nginx fixes the following issues - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled (bsc#1260415). - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420). - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229). - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module (bsc#1265231). - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module` (bsc#1265232). - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and `ngx_http_uwsgi_module` modules (bsc#1265233).

CVE-2026-43870 is a high-severity vulnerability in Apache Thrift before version 0.23.0 involving multiple security weaknesses: origin validation errors (CWE-346), path traversal (CWE-22), HTTP request/response splitting (CWE-113), and uncontrolled resource consumption (CWE-400). These issues can lead to limited confidentiality, integrity, and availability impacts. The Apache Software Foundation recommends upgrading to version 0.23.0 to address these vulnerabilities.

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVE-2025-15379 is a command injection vulnerability in MLflow's model serving container initialization code when deploying models with the env_manager set to LOCAL. The vulnerability arises because MLflow reads dependency specifications from the model artifact's python_env.yaml file and interpolates them directly into shell commands without sanitization. This allows an attacker who can supply a malicious model artifact to execute arbitrary commands with the permissions of the MLflow process. The flaw affects MLflow versions from 3.8.0 up to but not including 3.8.2, where it is fixed.

A path traversal vulnerability exists in the extract_archive_to_dir function of mlflow before version 3.9.0. This flaw allows an attacker controlling a tar.gz archive to overwrite arbitrary files on the system, potentially leading to privilege escalation or sandbox escape in multi-tenant or shared cluster environments. The vulnerability is critical and has an available patch.

Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

GitLab CE/EE versions from 18.10.0 up to but not including 18.10.4 and from 18.11.0 up to but not including 18.11.1 contain a vulnerability due to improper path validation. This flaw could allow an unauthenticated user to execute arbitrary JavaScript in another user's browser session. The issue has been remediated in versions 18.10.4 and 18.11.1.