CVE Vulnerability Catalog

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an OpenPixelCache call.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

The openTempFile function in Xpdf and Poppler 0.24.3 and earlier creates temporary files with predictable names when running on non-Unix systems. A local user can exploit a symlink attack to overwrite arbitrary files.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an AcquireSemaphoreInfo call.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.

A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, potentially leaking sensitive visual information that was removed from the main JPEG image.

A vulnerability in the Sanitize library allows bypassing CSS sanitization when <style> elements are allowed, when Sanitize::CSS#stylesheet or Sanitize::CSS#tree! is used to sanitize a stylesheet directly, or when output from Sanitize::CSS#properties is embedded inside a style rule. An attacker can inject malicious CSS, potentially leading to dangerous actions in the user's browser.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

Poppler 0.54.0 (as used in Evince and other products) has a NULL pointer dereference in JPXStream::readUByte in JPXStream.cc. Parsing an invalid PDF file causes a crash (segmentation fault).

In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference. This can lead to an application crash.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. This can lead to an application crash.

A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.

When a client is configured with a namespace, a request that hit a transient network error (timeout or connection closed by memcached or a proxy) was retried with the namespace applied a second time, so app:x became app:app:x.