Search CVE reports
1 – 10 of 38813 results
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media...
1 affected package
php-getid3
| Package | 26.04 LTS |
|---|---|
| php-getid3 | Needs evaluation |
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject...
1 affected package
php-getid3
| Package | 26.04 LTS |
|---|---|
| php-getid3 | Needs evaluation |
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
1 affected package
suricata
| Package | 26.04 LTS |
|---|---|
| suricata | Needs evaluation |
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to...
1 affected package
suricata
| Package | 26.04 LTS |
|---|---|
| suricata | Needs evaluation |
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
1 affected package
exim4
| Package | 26.04 LTS |
|---|---|
| exim4 | Needs evaluation |
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
1 affected package
exim4
| Package | 26.04 LTS |
|---|---|
| exim4 | Needs evaluation |
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
1 affected package
exim4
| Package | 26.04 LTS |
|---|---|
| exim4 | Needs evaluation |
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
1 affected package
exim4
| Package | 26.04 LTS |
|---|---|
| exim4 | Needs evaluation |
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume...
23 affected packages
expat, apache2, apr-util, cmake, ghostscript...
| Package | 26.04 LTS |
|---|---|
| expat | Needs evaluation |
| apache2 | Not affected |
| apr-util | Not affected |
| cmake | Not affected |
| ghostscript | Not affected |
| texlive-bin | Not affected |
| xmlrpc-c | Needs evaluation |
| vnc4 | Not in release |
| wbxml2 | Needs evaluation |
| swish-e | Needs evaluation |
| insighttoolkit4 | Not in release |
| cadaver | Needs evaluation |
| gdcm | Not affected |
| ayttm | Not in release |
| cableswig | Not in release |
| coin3 | Not affected |
| matanza | Ignored |
| tdom | Needs evaluation |
| vtk | Not in release |
| smart | Not in release |
| firefox | Not affected |
| thunderbird | Not affected |
| libxmltok | Not in release |
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name)...
1 affected package
rclone
| Package | 26.04 LTS |
|---|---|
| rclone | Needs evaluation |