ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a memory leak vulnerability in the handling of the -cdl (color decision list) option. This flaw causes allocated memory not to be freed after use, potentially leading to resource exhaustion if exploited repeatedly. The vulnerability has a low severity rating and a CVSS score of 3.3. No known exploits are reported in the wild.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability triggered by the use of the -set profile option. This flaw can cause memory exhaustion and potentially lead to denial of service if an attacker convinces a user to process crafted images using this option. The vulnerability has a low severity rating with a CVSS score of 3.3.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the handling of XMP profiles by various decoders. An attacker can supply images with crafted XMP profiles that cause memory to leak each time they are processed, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.3.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a memory leak vulnerability in their XML parsing code. The leak occurs when parsing reaches the nesting depth limit, causing allocated memory not to be released. An attacker can exploit this by supplying crafted deeply nested XML data to trigger memory exhaustion, resulting in a denial of service condition.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the JNG encoder. This flaw causes allocated memory to not be released when processing crafted JNG images, potentially leading to resource exhaustion and a limited denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a stack-based buffer overflow vulnerability in the handling of bzip2 compressed images. This flaw allows attackers to supply crafted bzip2 compressed images that can overwrite stack memory during decoding, potentially causing crashes or memory corruption. The vulnerability has a high severity rating with a CVSS score of 8.1.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have an injection vulnerability in the MVG encoder. This flaw allows attackers who can supply drawing options to inject arbitrary MVG drawing commands into generated MVG files. The vulnerability has a low severity with a CVSS score of 3.6 and requires local access with user interaction for exploitation.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a null pointer dereference vulnerability in the DJVU image decoder. This occurs because the software does not check the result of a memory allocation before use. An attacker can supply a specially crafted DJVU image that triggers a process crash under memory allocation failure conditions, resulting in denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the MSL decoder. This flaw causes allocated memory to not be released when processing crafted MSL images, potentially leading to resource exhaustion and denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-32 contain a security policy bypass vulnerability due to an incomplete fix of a previous bypass issue. This flaw allows an attacker who can supply input to ImageMagick to circumvent configured security policy restrictions, enabling operations that should have been blocked by the policy. The vulnerability has a low severity rating with a CVSS score of 3.9.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain an uncontrolled recursion vulnerability in the MVG decoder. This flaw can cause a stack overflow when processing specially crafted MVG files, leading to a denial of service by crashing the process. The vulnerability has a low severity rating and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a policy bypass vulnerability in the PS, PDF, and XPS decoders. This flaw allows attackers to circumvent the security policy's list length limit on scene selection by supplying a specific argument, causing ImageMagick to process more scenes than permitted. The vulnerability can potentially lead to resource exhaustion. The CVSS score is 3.3, indicating a low severity impact primarily affecting availability.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a vulnerability in delegate invocation parsing that allows execution of programs blocked by policy.xml. An attacker can exploit this by crafting input that triggers a delegate invocation, bypassing administrator-defined execution restrictions.
A vulnerability in python-virtualenv versions from 21.14.9 up to but not including 21.14.13 allows an attacker to inject commands via the --prompt value in the bash bin/activate script. This occurs because the prompt value is copied into the PS1 environment variable without escaping dollar signs or backticks when promptvars and POSIX mode are disabled. Subsequent re-enabling of promptvars or POSIX mode can cause command substitution and execution under the activating user's privileges. The issue is fixed in version 21.14.13.
A buffer overflow vulnerability exists in the Bluetooth HCI USB transport class of the Zephyr OS USB device stack. The flaw occurs because controller-to-host HCI packets are copied into a fixed-size USB transfer buffer without proper length checks, allowing memory corruption. This can be triggered remotely by an unauthenticated attacker within Bluetooth range via oversized HCI packets. The vulnerability can lead to arbitrary code execution on devices without memory protection or cause a denial of service if assertions are enabled.
A vulnerability in the Zephyr DNS stub resolver causes it to use a fixed UDP source port per configured server for DNS queries, violating RFC 5452 requirements. This allows an off-path attacker with UDP reachability to the device to predict the source port and attempt to spoof DNS responses by guessing only the 16-bit transaction ID. Successful spoofing can cause the application to resolve attacker-chosen addresses, potentially poisoning the DNS cache if enabled. The vulnerability is mitigated by a fix that randomizes the source port per query, increasing the guessing space.
The DHCPv4 client in Zephyr's network subsystem used a predictable transaction identifier (xid) for DHCP transactions, violating RFC 2131 requirements. This predictable xid allows an attacker on the same network segment or with prior knowledge of the xid to forge DHCP replies that the client accepts without verifying the server source. Such forged replies can redirect the device's network traffic by changing its default gateway and DNS resolvers, or disrupt network configuration by sending forged DHCPACK or DHCPNAK messages. The issue affects specific Zephyr versions and has a medium severity rating with a CVSS score of 5.6.
A vulnerability in Zephyr's arm64 MMU backend causes improper TLB invalidation, allowing user threads to retain access to stale memory mappings after page eviction. This flaw breaks memory isolation enforced by CONFIG_USERSPACE, enabling information disclosure and memory corruption, potentially leading to full system compromise. The issue affects arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled and demand-paged pages mapped into user memory domains. A fix changes the TLB invalidation to cover all ASIDs and both global and non-global entries, preventing stale translations from persisting.
A vulnerability in the Zephyr RTIO streaming completion callback adxl345_process_fifo_samples_cb() causes out-of-bounds writes when the allocated buffer is smaller than a full FIFO batch. This leads to silent corruption of other RTIO consumers' data or potential crashes. Exploitation requires specific hardware with an interrupt-wired ADXL345 sensor and certain buffer pool conditions, with no network or external input vector.
A vulnerability in the WireGuard VPN service implementation in Zephyr (subsys/net/lib/wireguard/wg.c) allows an attacker to spoof a UDP datagram to update a peer's endpoint address without authentication. This causes the peer to send handshake initiations and encrypted packets to an attacker-controlled address, resulting in persistent denial of service and potential traffic interception. The flaw occurs when the receiver index in a transport-data message does not match any session, leading to unauthenticated endpoint updates. The vulnerability affects Zephyr versions 3.1.2-1 and related builds. The issue is fixed by removing unauthenticated endpoint learning and requiring authenticated messages for endpoint updates.