CVE Vulnerability Catalog

The CVE record was rejected. Reason: this candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Reason: this candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE record was rejected. Rejection reason: the candidate was in a CNA pool that was not assigned to any issues.

The CVE was rejected — the candidate was in a CNA pool that was not assigned to any issue. There is no actual vulnerability to analyze.

Stack buffer overflow vulnerability in the OSDP Control Panel reply parser cp_decode_response() in Zephyr OS. For REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame without an upper bound check, allowing writes past the fixed 64-byte arrays in struct osdp_event. Requires CONFIG_OSDP in CP mode and a registered event callback.

The UpdateHub firmware-over-the-air client in Zephyr parses the CoAP probe response with the JSON library, which treats every descriptor field as optional. When the response omits the "sha256sum" field, the corresponding pointer stays NULL and the code calls strlen() on it before any validation, causing a read at address zero. Because the metadata is supplied entirely by the network peer (plain CoAP over UDP by default, without DTLS), an attacker can trigger the fault remotely.

Pillow from 8.2.0 until 13.0.0 can read past the tile buffer while copying four-byte pixels in the tiled-TIFF decoder. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation.

Pillow (Python imaging library) before 13.0.0 has raw decoders P;2L and P;4L that can read past the end of an input buffer. A mismatch between the calculated packed-pixel row size and the unpacker's actual footprint can disclose up to three adjacent heap bytes in output pixels or crash the process.

Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing data to be copied beyond the allocation. This is fixed in version 13.0.0.

Pillow from 5.1.0 until 13.0.0 allows PdfParser.get_value() to recurse without limit when reading nested PDF objects. An attacker can supply a deeply nested PDF to an application saving an image with PDF append enabled, causing an uncaught RecursionError or worker termination.

Pillow versions from 7.2.0 until 13.0.0 can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely.