Threat database

CFITSIO versions up to 4.7.0 contain an out-of-bounds write vulnerability in the ffgcls2() function. This flaw arises from trusting attacker-controlled heap descriptor lengths for variable-length string columns, allowing a crafted FITS file to overflow a fixed stack buffer and the caller's string array. The vulnerability can lead to arbitrary code execution.

CFITSIO versions up to 4.7.0 contain a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers. This flaw allows attackers to read memory before the fits_rand_value table by using a zero or negative ZDITHER0 seed in a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image. Exploitation occurs when the file is processed via fits_open_file() and fits_read_pix(), potentially causing crashes or leaking heap memory contents.

CFITSIO versions up to 4.7.0 contain a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder. This flaw allows attackers to read beyond the compressed tile buffer by supplying a crafted FITS file with an oversized tile geometry declaration. The vulnerability can cause application crashes or limited disclosure of heap memory when processing such files.