deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27483
Published: 2022-07-19
Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-049; https://fortiguard.com/psirt/FG-IR-22-049
CVE: CVE-2022-29057
Published: 2022-07-19
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0.0 allows a remote authenticated attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload into the Management Console via various endpoints.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-077; https://fortiguard.com/psirt/FG-IR-22-077
CVE: CVE-2022-29060
Published: 2022-07-19
Description: A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://fortiguard.com/psirt/FG-IR-22-071; https://fortiguard.com/psirt/FG-IR-22-071
CVE: CVE-2022-2453
Published: 2022-07-19
Description: Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/gpac/gpac/commit/dc7de8d3d604426c7a6e628d90cb9fb88e7b4c2c; https://huntr.dev/bounties/c8c964de-046a-41b2-9ff5-e25cfdb36b5a; https://github.com/gpac/gpac/commit/dc7de8d3d604426c7a6e628d90cb9fb88e7b4c2c
CVE: CVE-2022-2454
Published: 2022-07-19
Description: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://github.com/gpac/gpac/commit/faa75edde3dfeba1e2cf6ffa48e45a50f1042096; https://huntr.dev/bounties/105d40d0-46d7-461e-9f8e-20c4cdea925f; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2022-30301
Published: 2022-07-19
Description: A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-109; https://fortiguard.com/psirt/FG-IR-22-109
CVE: CVE-2022-30302
Published: 2022-07-19
Description: Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-21-213; https://fortiguard.com/psirt/FG-IR-21-213
CVE: CVE-2021-32504
Published: 2022-07-19
Description: Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-1984
Published: 2022-07-19
Description: This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow local authenticated attackers to elevate privileges via a malicious serialized payload.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://www.hypr.com/security-advisories/; https://www.hypr.com/security-advisories/
CVE: CVE-2022-24082
Published: 2022-07-19
Description: If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html; https://support.pega.com/support-doc/pega-security-advisory-b22-vulnerability-%E2%80%93-hotfix-matrix-0; http://packetstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html
CVE: CVE-2022-2192
Published: 2022-07-19
Description: Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425, CWE-425
References: https://www.hypr.com/security-advisories/; https://www.hypr.com/security-advisories/
CVE: CVE-2022-2193
Published: 2022-07-19
Description: Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-280, CWE-639
References: https://www.hypr.com/security-advisories/; https://www.hypr.com/security-advisories/
CVE: CVE-2022-35405
Published: 2022-07-19
Description: Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html; https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html; http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
CVE: CVE-2022-27544
Published: 2022-07-19
Description: BigFix Web Reports authorized users may see SMTP credentials in clear text.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998
CVE: CVE-2022-27545
Published: 2022-07-19
Description: BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998
CVE: CVE-2022-27579
Published: 2022-07-19
Description: A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Flexi Soft Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-27580
Published: 2022-07-19
Description: A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Safety Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-2469
Published: 2022-07-19
Description: GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client
CVSS Score: 3.8 (LOW)
CWE: CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json; https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d[PII_REDACTED]330bcc30; https://www.debian.org/security/2022/dsa-5189
CVE: CVE-2022-35912
Published: 2022-07-19
Description: In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2022/07/20/4; https://github.com/grails/grails-core/issues/12626; https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97
CVE: CVE-2022-22358
Published: 2022-07-19
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220651; https://www.ibm.com/support/pages/node/6604993; https://exchange.xforce.ibmcloud.com/vulnerabilities/220651
CVE: CVE-2022-22359
Published: 2022-07-19
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220652; https://www.ibm.com/support/pages/node/6604987; https://exchange.xforce.ibmcloud.com/vulnerabilities/220652
CVE: CVE-2022-22360
Published: 2022-07-19
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 220782.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220782; https://www.ibm.com/support/pages/node/6604995; https://exchange.xforce.ibmcloud.com/vulnerabilities/220782
CVE: CVE-2022-22416
Published: 2022-07-19
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 223126.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223126; https://www.ibm.com/support/pages/node/6604989; https://exchange.xforce.ibmcloud.com/vulnerabilities/223126
CVE: CVE-2022-22417
Published: 2022-07-19
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 223127.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223127; https://www.ibm.com/support/pages/node/6604991; https://exchange.xforce.ibmcloud.com/vulnerabilities/223127
CVE: CVE-2022-34001
Published: 2022-07-19
Description: Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://prisminfosec.com/cve-2022-34001/; https://prisminfosec.com/cve-2022-34001/
CVE: CVE-2022-34023
Published: 2022-07-19
Description: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /officials/officials.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.github.com; https://www.github.com
CVE: CVE-2022-27373
Published: 2022-07-19
Description: Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerability via the Ping function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/kitu232/feixun; https://github.com/kitu232/feixun
CVE: CVE-2022-2394
Published: 2022-07-19
Description: Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://puppet.com/security/cve/CVE-2022-2394; https://puppet.com/security/cve/CVE-2022-2394
CVE: CVE-2022-30570
Published: 2022-07-19
Description: The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with network access to obtain read access to application information on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.5.2 and below and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.2 and below.
CVSS Score: 6.5 (MEDIUM)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/06/tibco-security-advisory-july-19-2022-tdv-cve-2022-30570; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-34024
Published: 2022-07-19
Description: Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/resident/resident.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/sorabug/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/RCE-1.md; https://github.com/sorabug/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/RCE-1.md
CVE: CVE-2022-34169
Published: 2022-07-19
Description: The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html; http://www.openwall.com/lists/oss-security/2022/07/19/5; http://www.openwall.com/lists/oss-security/2022/07/19/6
CVE: CVE-2022-34025
Published: 2022-07-19
Description: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/serghey-rodin/vesta/issues/2252; https://github.com/serghey-rodin/vesta/issues/2252
CVE: CVE-2022-36303
Published: 2022-07-19
Description: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/serghey-rodin/vesta/issues/2252; https://github.com/serghey-rodin/vesta/issues/2252
CVE: CVE-2022-36304
Published: 2022-07-19
Description: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/serghey-rodin/vesta/issues/2252; https://github.com/serghey-rodin/vesta/issues/2252
CVE: CVE-2022-36305
Published: 2022-07-19
Description: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/serghey-rodin/vesta/issues/2252; https://github.com/serghey-rodin/vesta/issues/2252
CVE: CVE-2022-1920
Published: 2022-07-19
Description: Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190, CWE-787
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1226; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-1921
Published: 2022-07-19
Description: Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files. Potential for arbitrary code execution through heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1224; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-1922
Published: 2022-07-19
Description: DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-1923
Published: 2022-07-19
Description: DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-1924
Published: 2022-07-19
Description: DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-1925
Published: 2022-07-19
Description: DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-2122
Published: 2022-07-19
Description: DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190, CWE-787
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225; https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html; https://www.debian.org/security/2022/dsa-5204
CVE: CVE-2022-2476
Published: 2022-07-19
Description: A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x[PII_REDACTED]00 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/dbry/WavPack/issues/121; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CK45CC7MQ54SHEIJ63PW3HP4BCPTX6QP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMIXZWB3OURGBAEU3T5HQY56BN2ZVLYF/
CVE: CVE-2022-34266
Published: 2022-07-19
Description: The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html; https://bugs.gentoo.org/859433; https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html