deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3656
Published: 2022-11-01
Description: Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1345275; https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-3657
Published: 2022-11-01
Description: Use after free in Extensions in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1351177; https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-3658
Published: 2022-11-01
Description: Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1352817; https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-3659
Published: 2022-11-01
Description: Use after free in Accessibility in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1355560; https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-3660
Published: 2022-11-01
Description: Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1327505; https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-3661
Published: 2022-11-01
Description: Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1350111; https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-3723
Published: 2022-11-01
Description: Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html; https://crbug.com/1378239; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-26119
Published: 2022-11-02
Description: A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://fortiguard.com/psirt/FG-IR-22-064; https://fortiguard.com/psirt/FG-IR-22-064
CVE: CVE-2022-26122
Published: 2022-11-02
Description: An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-345
References: https://fortiguard.com/psirt/FG-IR-22-074; https://fortiguard.com/psirt/FG-IR-22-074
CVE: CVE-2022-30307
Published: 2022-11-02
Description: A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack.
CVSS Score: 3.9 (LOW)
References: https://fortiguard.com/psirt/FG-IR-22-228; https://fortiguard.com/psirt/FG-IR-22-228
CVE: CVE-2022-33870
Published: 2022-11-02
Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3.0.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-070; https://fortiguard.com/psirt/FG-IR-22-070
CVE: CVE-2022-33878
Published: 2022-11-02
Description: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local authenticated attacker to obtain the SSL-VPN password in cleartext via running a logstream for the FortiTray process in the terminal.
CVSS Score: 2.2 (LOW)
CWE: CWE-200
References: https://fortiguard.com/psirt/FG-IR-22-246; https://fortiguard.com/psirt/FG-IR-22-246
CVE: CVE-2022-35842
Published: 2022-11-02
Description: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://fortiguard.com/psirt/FG-IR-22-223; https://fortiguard.com/psirt/FG-IR-22-223
CVE: CVE-2022-35851
Published: 2022-11-02
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-314; https://fortiguard.com/psirt/FG-IR-22-314
CVE: CVE-2022-38372
Published: 2022-11-02
Description: A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow a local, privileged user to obtain a root shell on the device via an undocumented command.
CVSS Score: 6.7 (MEDIUM)
References: https://fortiguard.com/psirt/FG-IR-22-283; https://fortiguard.com/psirt/FG-IR-22-283
CVE: CVE-2022-38373
Published: 2022-11-02
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-331; https://fortiguard.com/psirt/FG-IR-22-331
CVE: CVE-2022-38374
Published: 2022-11-02
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-232; https://fortiguard.com/psirt/FG-IR-22-232
CVE: CVE-2022-38380
Published: 2022-11-02
Description: An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API.
CVSS Score: 4.3 (MEDIUM)
References: https://fortiguard.com/psirt/FG-IR-22-174; https://fortiguard.com/psirt/FG-IR-22-174
CVE: CVE-2022-38381
Published: 2022-11-02
Description: An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall (WAF) protection such as the SQL Injection and XSS filters via a malformed HTTP request.
CVSS Score: 5.3 (MEDIUM)
References: https://fortiguard.com/psirt/FG-IR-22-234; https://fortiguard.com/psirt/FG-IR-22-234
CVE: CVE-2022-39945
Published: 2022-11-02
Description: An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://fortiguard.com/psirt/FG-IR-22-066; https://fortiguard.com/psirt/FG-IR-22-066
CVE: CVE-2022-39949
Published: 2022-11-02
Description: An improper control of a resource through its lifetime vulnerability [CWE-664] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 through 5.0.3.751, 5.1.0 may allow a privileged user to terminate the FortiEDR processes with special tools and bypass the EDR protection.
CVSS Score: 4.4 (MEDIUM)
References: https://fortiguard.com/psirt/FG-IR-22-218; https://fortiguard.com/psirt/FG-IR-22-218
CVE: CVE-2022-39950
Published: 2022-11-02
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-21-228; https://fortiguard.com/psirt/FG-IR-21-228
CVE: CVE-2022-42473
Published: 2022-11-02
Description: A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose information via logging into the database using a privileged account without a password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://fortiguard.com/psirt/FG-IR-22-216; https://fortiguard.com/psirt/FG-IR-22-216
CVE: CVE-2022-43982
Published: 2022-11-02
Description: In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/apache/airflow/pull/27143; https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l; https://github.com/apache/airflow/pull/27143
CVE: CVE-2022-43985
Published: 2022-11-02
Description: In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/apache/airflow/pull/27143; https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq; https://github.com/apache/airflow/pull/27143
CVE: CVE-2021-37789
Published: 2022-11-02
Description: stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/nothings/stb/issues/1178; https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html; https://github.com/nothings/stb/issues/1178
CVE: CVE-2022-39379
Published: 2022-11-02
Description: Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
CVSS Score: 3.1 (LOW)
CWE: CWE-502, CWE-502
References: https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135; https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/
CVE: CVE-2022-3809
Published: 2022-11-02
Description: A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/axiomatic-systems/Bento4/files/9653209/poc_Bento4.zip; https://github.com/axiomatic-systems/Bento4/issues/779; https://vuldb.com/?id.212666
CVE: CVE-2022-3810
Published: 2022-11-02
Description: A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212667.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://github.com/axiomatic-systems/Bento4/files/9653209/poc_Bento4.zip; https://github.com/axiomatic-systems/Bento4/issues/779; https://vuldb.com/?id.212667
CVE: CVE-2022-3825
Published: 2022-11-02
Description: A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212792.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707
References: https://github.com/Ha0Liu/cveAdd/blob/developer/README.EN.md; https://vuldb.com/?id.212792; https://github.com/Ha0Liu/cveAdd/blob/developer/README.EN.md
CVE: CVE-2022-3826
Published: 2022-11-02
Description: A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retail Management. The manipulation of the argument search leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212793 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266
References: https://github.com/Ha0Liu/cveAdd/blob/developer/README.EN.yuequan.md; https://vuldb.com/?id.212793; https://github.com/Ha0Liu/cveAdd/blob/developer/README.EN.yuequan.md
CVE: CVE-2022-3827
Published: 2022-11-02
Description: A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql injection. The attack can be initiated remotely. The name of the patch is 293b10628f7d9f83c6c82c78cf637cbe9b907369. It is recommended to apply a patch to fix this issue. VDB-212794 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707
References: https://github.com/centreon/centreon/commit/293b10628f7d9f83c6c82c78cf637cbe9b907369; https://github.com/centreon/centreon/pull/11869; https://vuldb.com/?id.212794
CVE: CVE-2022-40840
Published: 2022-11-02
Description: ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://ndkadvancedcustomizationfields.com; https://github.com/daaaalllii/cve-s/blob/main/CVE-2022-40840/poc.txt; http://ndkadvancedcustomizationfields.com
CVE: CVE-2022-43670
Published: 2022-11-02
Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/11/02/8; https://lists.apache.org/thread/o68l3l3crfxz107fr9dm74y8vg8kj2cs; http://www.openwall.com/lists/oss-security/2022/11/02/8
CVE: CVE-2022-43235
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/337; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43236
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/strukturag/libde265/issues/343; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43237
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/344; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43238
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/strukturag/libde265/issues/336; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43239
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/341; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43240
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/335; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43241
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/338; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43242
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/340; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43243
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/339; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43244
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/342; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43245
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/strukturag/libde265/issues/352; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43248
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/349; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43249
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/345; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346