Threats tagged 'swifturl'

The container tool version 0.12.2 and earlier contains a vulnerability in the `container system dns create --localhost` command where the domainName argument is not sanitized. This allows injection of arbitrary pf firewall rules into the macOS kernel packet filter configuration. The vulnerability enables an attacker with sudo access to this command to escalate privileges by writing arbitrary firewall rules, bypassing the intended restriction to localhost redirects only. The issue is fixed in version 0.12.3.

LeafKit versions prior to 1.14.2 have a cross-site scripting (XSS) vulnerability due to improper HTML escaping when rendering collections (arrays or dictionaries) in templates. The vulnerability arises because LeafKit's htmlEscaped() method returns unescaped data for collections, allowing potentially untrusted input to be rendered without escaping. This can lead to XSS attacks when user-controlled data is included in arrays or dictionaries rendered via #(value) in Leaf templates.

ExecuTorch versions prior to 0.7.0 contain heap-based buffer overflow vulnerabilities in the model loading process. These vulnerabilities can cause the runtime to crash and may allow code execution or other harmful effects. The issue is fixed in version 0.7.0.

An integer overflow vulnerability in ExecuTorch versions prior to 0.7.0 can cause overlapping memory allocations when loading models. This flaw may lead to arbitrary code execution or other severe impacts. The vulnerability is identified as CVE-2025-30404 and has a critical severity rating with a CVSS score of 9.8. A fix is available in ExecuTorch version 0.7.0.

An out-of-bounds access vulnerability in ExecuTorch versions prior to 0.7.0 can cause the runtime to crash and may lead to code execution or other harmful effects. This critical vulnerability is identified as CVE-2025-54950 and has a high CVSS score of 9.8. The issue is fixed in version 0.7.0.

ExecuTorch versions prior to 0.7.0 contain a heap buffer overflow vulnerability in the model loading component. This flaw can lead to remote code execution or other severe impacts. The vulnerability is tracked as CVE-2025-54949 and has a critical CVSS score of 9.8. A fix is available in version 0.7.0.

An integer overflow vulnerability in ExecuTorch prior to version 0.7.0 allows improper memory handling during model loading, which can lead to code execution or other harmful effects. This critical flaw has a CVSS score of 9.8 and is fixed in version 0.7.0.

ExecuTorch versions prior to 0.7.0 and 0.7.0-rc1 contain a heap-based buffer overflow vulnerability in the method loading process. This flaw can cause the runtime to crash and may allow an attacker to execute arbitrary code or cause other harmful effects. The vulnerability is tracked as CVE-2025-30402 and has a high severity rating with a CVSS score of 8.1. A fix is available in versions 0.7.0 and 0.7.0-rc1.