CVE Vulnerability Catalog

Vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. The HTTP_REDIRECT_STATUS variable used to check if CGI is run by the HTTP server can be controlled by the request submitter via HTTP headers.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.

A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.

The GD Graphics Library (LibGD) through version 2.3.2 has an out-of-bounds read due to the lack of certain gdGetBuf and gdPutBuf return value checks.

Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

Libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow, leading to a heap-based buffer overflow when processing sector allocation.

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.

A TOCTOU race condition in pg_dump in PostgreSQL allows an object creator to replace another relation type with a view or foreign table, executing arbitrary SQL functions as the user running pg_dump, often a superuser. The attack requires waiting for the right moment.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.

The Diffie-Hellman Key Agreement Protocol allows long exponents, making certain calculations unnecessarily expensive. The 1996 van Oorschot and Wiener paper showed that appropriately short exponents can be used with adequate subgroup constraints, but these are not utilized.

In libxml2 before 2.11.0, xmlXIncludeAddNode in xinclude.c has a use-after-free vulnerability.