deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29050
Published: 2024-01-08
Description: The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.


CVSS Score: 7.6 (HIGH)
CWE: CWE-90, CWE-74
References: http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html; http://seclists.org/fulldisclosure/2024/Jan/3; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json
CVE: CVE-2023-29051
Published: 2024-01-08
Description: User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf; http://seclists.org/fulldisclosure/2024/Jan/4
CVE: CVE-2023-29052
Published: 2024-01-08
Description: Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf; http://seclists.org/fulldisclosure/2024/Jan/4
CVE: CVE-2023-41710
Published: 2024-01-08
Description: User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf; http://seclists.org/fulldisclosure/2024/Jan/4
CVE: CVE-2024-0305
Published: 2024-01-08
Description: A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/[PII_REDACTED]/cve/blob/main/logic.md; https://vuldb.com/?ctiid.249872; https://vuldb.com/?id.249872
CVE: CVE-2024-0306
Published: 2024-01-08
Description: A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_login_process.php. The manipulation of the argument admin_password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249873 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Dynamic%20Lab%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.249873; https://vuldb.com/?id.249873
CVE: CVE-2023-5091
Published: 2024-01-08
Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-0307
Published: 2024-01-08
Description: A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login_process.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249874 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/VistaAX/vulnerablility/blob/main/Dynamic%20Lab%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.249874; https://vuldb.com/?id.249874
CVE: CVE-2024-0308
Published: 2024-01-08
Description: A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument p_url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249875.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://note.zhaoj.in/share/2E2JG2PClHGF; https://vuldb.com/?ctiid.249875; https://vuldb.com/?id.249875
CVE: CVE-2023-6921
Published: 2024-01-08
Description: Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cert.pl/en/posts/2024/01/CVE-2023-6921/; https://cert.pl/posts/2024/01/CVE-2023-6921/; https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html
CVE: CVE-2023-6552
Published: 2024-01-08
Description: Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://cert.pl/en/posts/2024/01/CVE-2023-6552/; https://cert.pl/posts/2024/01/CVE-2023-6552/; https://github.com/TasmoAdmin/TasmoAdmin/pull/1039
CVE: CVE-2024-0321
Published: 2024-01-08
Description: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://github.com/gpac/gpac/commit/d0ced41651b279bb054eb6390751e2d4eb84819a; https://huntr.com/bounties/4c027b94-8e9c-4c31-a169-893b25047769; https://github.com/gpac/gpac/commit/d0ced41651b279bb054eb6390751e2d4eb84819a
CVE: CVE-2024-0322
Published: 2024-01-08
Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/gpac/gpac/commit/092904b80edbc4dce315684a59cc3184c45c1b70; https://huntr.com/bounties/87611fc9-ed7c-43e9-8e52-d83cd270bbec; https://github.com/gpac/gpac/commit/092904b80edbc4dce315684a59cc3184c45c1b70
CVE: CVE-2023-51701
Published: 2024-01-08
Description: fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0. 

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0; https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp; https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0
CVE: CVE-2023-7224
Published: 2024-01-08
Description: OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable
CVSS Score: 7.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
CVE: CVE-2024-21644
Published: 2024-01-08
Description: pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/pyload/pyload/commit/bb22063a875ffeca357aaf6e2edcd09705688c40; https://github.com/pyload/pyload/security/advisories/GHSA-mqpq-2p68-46fv; https://github.com/pyload/pyload/commit/bb22063a875ffeca357aaf6e2edcd09705688c40
CVE: CVE-2024-21645
Published: 2024-01-08
Description: pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/pyload/pyload/commit/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d; https://github.com/pyload/pyload/security/advisories/GHSA-ghmw-rwh8-6qmr; https://github.com/pyload/pyload/commit/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d
CVE: CVE-2024-21647
Published: 2024-01-08
Description: Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-444
References: https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93; https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2; https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
CVE: CVE-2023-32650
Published: 2024-01-08
Description: An integer overflow vulnerability exists in the FST_BL_GEOM parsing maxhandle functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-190, CWE-190
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1777; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-34087
Published: 2024-01-08
Description: An improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. A specially crafted .evcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1803; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-34436
Published: 2024-01-08
Description: An out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1819; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35004
Published: 2024-01-08
Description: An integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1816; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35057
Published: 2024-01-08
Description: An integer overflow vulnerability exists in the LXT2 lxt2_rd_trace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1821; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35128
Published: 2024-01-08
Description: An integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-190, CWE-190
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1792; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35702
Published: 2024-01-08
Description: Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32 function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35703
Published: 2024-01-08
Description: Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint64 function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35704
Published: 2024-01-08
Description: Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32WithSkip function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35955
Published: 2024-01-08
Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `LZ4_decompress_safe_partial`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1785; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35956
Published: 2024-01-08
Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `fastlz_decompress`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1785; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35957
Published: 2024-01-08
Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `uncompress`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1785; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35958
Published: 2024-01-08
Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the copy function `fstFread`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1785; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35959
Published: 2024-01-08
Description: Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns `.ghw` decompression.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35960
Published: 2024-01-08
Description: Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy decompression in `vcd_main`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35961
Published: 2024-01-08
Description: Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in `vcd_recorder_main`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35962
Published: 2024-01-08
Description: Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2vzt` utility.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35963
Published: 2024-01-08
Description: Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt2` utility.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35964
Published: 2024-01-08
Description: Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt` utility.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE: CVE-2023-35969
Published: 2024-01-08
Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of `FST_BL_VCDATA` and `FST_BL_VCDATA_DYN_ALIAS` section types.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1789; https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html