Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-8341 State: PUBLISHED Published: 2019-02-15T07:00:00 Last Updated: 2024-08-04T21:17:30.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JameelNabbo/Jin
s without sandboxing Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JameelNabbo/Jinja2-Code-execution - https://www.exploit-db.com/exploits/46386/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html - https://bugzilla.redhat.com/show_bug.cgi?id=1677653 - https://bugzilla.suse.com/show_bug.cgi?id=1125815
CVE ID: CVE-2019-8342 State: PUBLISHED Published: 2019-05-13T16:05:24 Last Updated: 2024-08-04T21:17:30.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2019-8343 State: PUBLISHED Published: 2019-02-15T07:00:00Z Last Updated: 2024-09-16T18:33:18.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392556 - https://security.gentoo.org/glsa/202312-09
CVE ID: CVE-2019-8345 State: PUBLISHED Published: 2019-02-15T14:00:00Z Last Updated: 2024-09-17T00:46:57.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=BtLUO-ujJ7I
CVE ID: CVE-2019-8346 State: PUBLISHED Published: 2019-05-24T16:48:36 Last Updated: 2024-08-04T21:17:30.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html
CVE ID: CVE-2019-8347 State: PUBLISHED Published: 2019-02-15T15:00:00 Last Updated: 2024-08-04T21:17:30.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin_member.php?action=add&nav=add_web_user&admin_p_nav=user URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/beescms/issues/4
CVE ID: CVE-2019-8349 State: PUBLISHED Published: 2019-05-08T13:24:32 Last Updated: 2024-08-04T21:17:30.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parameter to delete feature; the (2) destination parameter to edit feature; (3) content parameter in the profile feature. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151733/HTMLy-2.7.4-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Feb/40 - https://www.netsparker.com/web-applications-advisories/
CVE ID: CVE-2019-8350 State: PUBLISHED Published: 2019-05-13T13:31:45 Last Updated: 2024-08-04T21:17:30.773Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AC:L/AV:P/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulnerability that leaked the user's password to the keyboard autocomplete functionality. Third-party Android keyboards that capture the password may store this password in cleartext, or transmit the password to third-party services for keyboard customization purposes. A compromise of any datastore that contains keyboard au
ord to third-party services for keyboard customization purposes. A compromise of any datastore that contains keyboard autocompletion caches would result in the disclosure of the user's Simple Bank password. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2019/02/simple-better-banking-android-v-2-45-0-2-45-3-sensitive-information-disclosure/ - https://www.simple.com/policies/security
CVE ID: CVE-2019-8351 State: PUBLISHED Published: 2019-03-21T20:28:40 Last Updated: 2024-08-04T21:17:31.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers, which allows remote attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://support.heimdalsecurity.com/hc/en-us/articles/360001084158-Release-2-5-172-PROD-Update
CVE ID: CVE-2019-8352 State: PUBLISHED Published: 2019-05-20T18:32:32 Last Updated: 2024-08-04T21:17:31.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network. Additional Analyst Notes: - CVE Program Container: References: - https://www.securifera.com/advisories/CVE-2019-8352/
CVE ID: CVE-2019-8354 State: PUBLISHED Published: 2019-02-15T23:00:00 Last Updated: 2024-08-04T21:17:30.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sox/bugs/319 - https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html - https://usn.ubuntu.com/4079-1/ - https://usn.ubuntu.com/4079-2/
CVE ID: CVE-2019-8355 State: PUBLISHED Published: 2019-02-15T23:00:00 Last Updated: 2024-08-04T21:17:30.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sox/bugs/320 - https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html - https://usn.ubuntu.com/4079-1/ - https://usn.ubuntu.com/4079-2/
CVE ID: CVE-2019-8356 State: PUBLISHED Published: 2019-02-15T23:00:00 Last Updated: 2024-08-04T21:17:31.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sox/bugs/321 - https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html - https://usn.ubuntu.com/4079-1/ - https://usn.ubuntu.com/4079-2/
CVE ID: CVE-2019-8357 State: PUBLISHED Published: 2019-02-15T23:00:00 Last Updated: 2024-08-04T21:17:30.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sox/bugs/318 - https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html - https://usn.ubuntu.com/4079-1/ - https://usn.ubuntu.com/4079-2/
CVE ID: CVE-2019-8358 State: PUBLISHED Published: 2019-02-16T18:00:00Z Last Updated: 2024-09-16T17:59:07.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.hiawatha-webserver.org/changelog
CVE ID: CVE-2019-8359 State: PUBLISHED Published: 2020-04-23T12:33:35 Last Updated: 2024-08-04T21:17:30.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. An out of bounds write is present in the data section during 6LoWPAN fragment re-assembly in the face of forged fragment offsets in os/net/ipv6/sicslowpan.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/pull/972 - https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.4 - https://www.usenix.org/system/files/sec20summer_clements_prepub.pdf
CVE ID: CVE-2019-8360 State: PUBLISHED Published: 2019-02-16T22:00:00 Last Updated: 2024-08-04T21:17:30.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Themerig Find a Place CMS Directory 1.5 has SQL Injection via the find/assets/external/data_2.php cate parameter. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/151706/Find-A-Place-CMS-Directory-1.5-SQL-Injection.html
CVE ID: CVE-2019-8361 State: PUBLISHED Published: 2019-02-16T22:00:00 Last Updated: 2024-08-04T21:17:30.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection. Additional Analyst Notes: - CVE Program Container: References: - https://hackingvila.wordpress.com/2019/02/16/url-redirection-through-html-injection-in-responsive-video-news-script-php-script-mall/ - https://hackingvila.wordpress.com/2019/02/16/xss-vulnerability-in-responsive-video-news-script-php-script-mall/
CVE ID: CVE-2019-8362 State: PUBLISHED Published: 2019-02-16T22:00:00 Last Updated: 2024-08-04T21:17:31.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, or .gif is present as a substring, and does not otherwise check the file name or content). Additional Analyst Notes: - CVE Program Container: References: - http://tusk1.cn/2019/02/16/dedecms%20v5.7%20sp2%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8
ram Container: References: - http://tusk1.cn/2019/02/16/dedecms%20v5.7%20sp2%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/
CVE ID: CVE-2019-8363 State: PUBLISHED Published: 2019-02-16T22:00:00 Last Updated: 2024-08-04T21:17:31.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Verytops/verydows/issues/12
CVE ID: CVE-2019-8368 State: PUBLISHED Published: 2019-09-16T17:02:39 Last Updated: 2024-08-04T21:17:31.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR v5.0.1-6 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/openemr-5-0-16-remote-code-execution-cross-site-scripting
CVE ID: CVE-2019-8369 State: REJECTED Published: 2019-10-21T16:58:22 Last Updated: 2019-10-21T16:58:22 Description: No description available.
CVE ID: CVE-2019-8370 State: REJECTED Published: 2019-10-21T17:01:40 Last Updated: 2019-10-21T17:01:40 Description: No description available.
CVE ID: CVE-2019-8371 State: PUBLISHED Published: 2019-09-16T16:45:35 Last Updated: 2024-08-04T21:17:31.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR v5.0.1-6 allows code execution. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/openemr-5-0-16-remote-code-execution-cross-site-scripting
CVE ID: CVE-2019-8372 State: PUBLISHED Published: 2019-02-18T15:00:00 Last Updated: 2024-08-04T21:17:31.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory via specially crafted IOCTL requests and elevate system privileges. This occurs because the device object has an associated symbolic link and an open DACL. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/Jackson_T/status/1097353402034475009 - http://www.jackson-t.ca/lg-driver-lpe.html - https://lgsecurity.lge.com/security_updates.htm
tatus/1097353402034475009 - http://www.jackson-t.ca/lg-driver-lpe.html - https://lgsecurity.lge.com/security_updates.html
CVE ID: CVE-2019-8375 State: PUBLISHED Published: 2019-02-24T13:00:00 Last Updated: 2024-08-04T21:17:31.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany). Additional Analyst Notes:
.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany). Additional Analyst Notes: - CVE Program Container: References: - https://trac.webkit.org/changeset/241515/webkit - https://www.exploit-db.com/exploits/46465/ - https://github.com/WebKit/webkit/commit/6f9b511a115311b13c06eb58038ddc2c78da5531 - https://www.inputzero.io/2019/02/fuzzing-webkit.html - https://bugs.webkit.org/show_bug.cgi?id=184875 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00058.html - https://usn.ubuntu.com/3948-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00005.html
CVE ID: CVE-2019-8376 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/537 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-ge
appneta/tcpreplay/issues/537 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-get_layer4_v6-tcpreplay-4-3-1/ - http://www.securityfocus.com/bid/107085 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/
CVE ID: CVE-2019-8377 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/536 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function
om/appneta/tcpreplay/issues/536 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-get_ipv6_l4proto-tcpreplay-4-3-1/ - http://www.securityfocus.com/bid/107085 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4YAT4
2DIWJAFKTBJCAW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4YAT4AGTHQKB74ETOQPJMV67TSDIAPOC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UOSEIQ3D2OONCJEVMGC2TYBC2QX4E5EJ/
CVE ID: CVE-2019-8378 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4_BitStream::ReadBytes() in Codecs/Ap4BitStream.cpp, a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/363 - https://research.loginsoft.com/bugs/a-heap-buffer-o
ferences: - https://github.com/axiomatic-systems/Bento4/issues/363 - https://research.loginsoft.com/bugs/a-heap-buffer-overflow-vulnerability-in-the-function-ap4_bitstreamreadbytes-bento4-1-5-1-628/
CVE ID: CVE-2019-8379 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/advancemame/bugs/271/ - https://research.loginsoft.com/bugs/null-pointer-derefer
References: - https://sourceforge.net/p/advancemame/bugs/271/ - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-the-function-be_uint32_read-advancecomp/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/ - https://access.redhat.com/errata/RHSA-2019:2332 - https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html
CVE ID: CVE-2019-8380 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in AP4_Track::GetSampleIndexForTimeStampMs() located in Core/Ap4Track.cpp. It can triggered by sending a crafted file to the mp4audioclip binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/366 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerabi
/github.com/axiomatic-systems/Bento4/issues/366 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-ap4_trackgetsampleindexfortimestampms-bento4-1-5-1-628/
CVE ID: CVE-2019-8381 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/538 - https://research.loginsoft.com/bugs/invalid-memory-access-vulnerability-in-function-do_checksum-tcpreplay-4-3-1/ -
38 - https://research.loginsoft.com/bugs/invalid-memory-access-vulnerability-in-function-do_checksum-tcpreplay-4-3-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/
CVE ID: CVE-2019-8382 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in the function AP4_List:Find located in Core/Ap4List.h when called from Core/Ap4Movie.cpp. It can be triggered by sending a crafted file to the mp4dump binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/364 - https://research.loginsoft.com/bugs/null-pointer-derefe
nces: - https://github.com/axiomatic-systems/Bento4/issues/364 - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-ap4_listfind-bento4-1-5-1-628/
CVE ID: CVE-2019-8383 State: PUBLISHED Published: 2019-02-17T02:00:00 Last Updated: 2024-08-04T21:17:31.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/invalid-memory-access-in-adv_png_unfilter_8-advancecomp/ - https://sourceforge