ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have an injection vulnerability in the MVG encoder. This flaw allows attackers who can supply drawing options to inject arbitrary MVG drawing commands into generated MVG files. The vulnerability has a low severity with a CVSS score of 3.6 and requires local access with user interaction for exploitation.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a null pointer dereference vulnerability in the DJVU image decoder. This occurs because the software does not check the result of a memory allocation before use. An attacker can supply a specially crafted DJVU image that triggers a process crash under memory allocation failure conditions, resulting in denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the MSL decoder. This flaw causes allocated memory to not be released when processing crafted MSL images, potentially leading to resource exhaustion and denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-32 contain a security policy bypass vulnerability due to an incomplete fix of a previous bypass issue. This flaw allows an attacker who can supply input to ImageMagick to circumvent configured security policy restrictions, enabling operations that should have been blocked by the policy. The vulnerability has a low severity rating with a CVSS score of 3.9.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain an uncontrolled recursion vulnerability in the MVG decoder. This flaw can cause a stack overflow when processing specially crafted MVG files, leading to a denial of service by crashing the process. The vulnerability has a low severity rating and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a policy bypass vulnerability in the PS, PDF, and XPS decoders. This flaw allows attackers to circumvent the security policy's list length limit on scene selection by supplying a specific argument, causing ImageMagick to process more scenes than permitted. The vulnerability can potentially lead to resource exhaustion. The CVSS score is 3.3, indicating a low severity impact primarily affecting availability.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a vulnerability in delegate invocation parsing that allows execution of programs blocked by policy.xml. An attacker can exploit this by crafting input that triggers a delegate invocation, bypassing administrator-defined execution restrictions.
Python 2.7's ssl module has been updated to include a denylist of known compromised certificates. This denylist ensures that such certificates are automatically rejected even if certificate revocation checking is not configured. The update enhances user safety by preventing the acceptance of compromised certificates regardless of SSLContext policy settings.
An integer overflow vulnerability exists in open62541 versions 1.5.0 through 1.5.6 in the UA_DataType_fromStructureDescription() function. This overflow affects the 16-bit memSize field for large custom structure definitions, allowing a malicious OPC UA server to cause a heap overflow in clients via crafted DataType definitions. Exploitation can lead to client crashes or potentially remote code execution. The issue is fixed in version 1.5.7.
Twisted versions prior to 26.10.0rc1 have a vulnerability in twisted.web.http.HTTPChannel.headerReceived where it rejects NUL bytes in HTTP header values but accepts bare carriage return or line feed characters. This allows a hidden Content-Length header to be folded into another header value, causing a framing disagreement between Twisted and lenient front ends. This can enable HTTP request smuggling, potentially bypassing front-end access controls, poisoning shared connections or caches, and exposing clients to incorrect responses. The issue is a residual flaw from incomplete fixes in earlier request-smuggling protections and is resolved in version 26.10.0rc1.
A vulnerability in Twisted prior to version 26.10.0rc1 allows an unauthenticated attacker to cause memory exhaustion by exploiting the Telnet subnegotiation buffer. The Telnet.dataReceived method appends every byte received after the IAC SB command to a persistent buffer without a maximum length until the IAC SE terminator is received. Since Telnet option negotiation happens before authentication, an attacker can omit the terminator and cause continuous buffer growth, leading to process termination.
A vulnerability in Twisted's IRC protocol implementation prior to version 26.10.0rc1 allows unauthenticated connections to cause unbounded memory growth by continuously sending bytes without a line feed. This can exhaust server memory and cause denial of service by dropping all users. The issue is fixed in version 26.10.0rc1.
A vulnerability in the twisted.words.xish.domish ExpatElementStream parser prior to version 26.10.0rc1 allows an unauthenticated remote peer to exhaust server memory by keeping a container element open and continuously adding child elements. This occurs during XMPP pre-authentication stream parsing before credentials are accepted. The issue is fixed in version 26.10.0rc1.
A vulnerability in Twisted's IMAP4Server prior to version 26.10.0rc1 allows an authenticated client to send a SEARCH command with a negative literal size. This causes the parser cursor to move below zero, triggering a synchronous scanning loop that freezes the single-threaded reactor. As a result, all IMAP connections and any SMTP or POP3 services hosted in the same process become unresponsive until the service is restarted. The issue is fixed in version 26.10.0rc1.
Echo's WebSocket proxy middleware in versions 4.15.0 through 4.16.0 and 5.0.0 through 5.4.0 can retain connections and handlers after a WebSocket client disconnects if the upstream server keeps its connection open. This resource retention can accumulate with repeated connections, potentially causing denial of service. The issue does not affect confidentiality or integrity. Fixed in versions 4.16.1 and 5.4.1.
Echo v4's optional Decompress middleware for gzip requests allowed unbounded decompression size, enabling a small compressed request to expand into a very large body. This could cause excessive memory or CPU consumption, leading to denial of service. The middleware is not enabled by default. Versions prior to 4.16.1 are affected. The issue is fixed in Echo v4.16.1 by adding a configurable maximum decompressed size limit.
Echo versions prior to v4.16.1 and v5.4.1 contain a vulnerability where rejected WebSocket upgrade requests can bypass route-level access controls. This occurs because Echo's proxy middleware forwards subsequent HTTP requests on a connection with a rejected upgrade directly to the upstream without passing through Echo's router or middleware, potentially bypassing authentication or authorization enforced at Echo routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. Fixed in versions v4.16.1 and v5.4.1.
A vulnerability in python-virtualenv versions from 21.14.9 up to but not including 21.14.13 allows an attacker to inject commands via the --prompt value in the bash bin/activate script. This occurs because the prompt value is copied into the PS1 environment variable without escaping dollar signs or backticks when promptvars and POSIX mode are disabled. Subsequent re-enabling of promptvars or POSIX mode can cause command substitution and execution under the activating user's privileges. The issue is fixed in version 21.14.13.