vuln-osv update 2026-11-13T00:44:09Z
This commit is contained in:
Vulnerability Bot committed
1 parent
8a2c5b2e77
commit
ccfb9c50cb
167 files changed
+200
-83
No files matched your search
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"GHSA-22fx-6r9m-r8h9","published":"2023-05-05T18:30:17Z","modified":"2025-01-29T22:00:08Z","aliases":["CVE-2023-29659"],"summary":"libheif vulnerable to segmentation fault via floating point exception","details":"A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.","affected":[{"package":{"name":"github.com/strukturag/libheif","ecosystem":"Go","purl":"pkg:golang/github.com/strukturag/libheif"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29659"},{"type":"WEB","url":"https://github.com/strukturag/libheif/issues/794"},{"type":"WEB","url":"https://github.com/strukturag/libheif/commit/e05e15b57a38ec411cb9acb38512a1c36ff62991"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"},{"type":"PACKAGE","url":"github.com/strukturag/libheif"}],"database_specific":{"cwe_ids":["CWE-369"],"github_reviewed":true,"github_reviewed_at":"2023-06-02T21:18:04Z","nvd_published_at":"2023-05-05T16:15:09Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}
|
||||
{"schema_version":"1.9.2","id":"GHSA-22fx-6r9m-r8h9","published":"2023-05-05T18:30:17Z","modified":"2026-11-12T22:45:03.578496051Z","aliases":["CVE-2023-29659"],"summary":"libheif vulnerable to segmentation fault via floating point exception","details":"A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.","affected":[{"package":{"name":"github.com/strukturag/libheif","ecosystem":"Go","purl":"pkg:golang/github.com/strukturag/libheif"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29659"},{"type":"WEB","url":"https://github.com/strukturag/libheif/issues/794"},{"type":"WEB","url":"https://github.com/strukturag/libheif/commit/e05e15b57a38ec411cb9acb38512a1c36ff62991"},{"type":"PACKAGE","url":"https://github.com/strukturag/libheif"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"}],"database_specific":{"cwe_ids":["CWE-369"],"github_reviewed":true,"github_reviewed_at":"2023-06-02T21:18:04Z","nvd_published_at":"2023-05-05T16:15:09Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-5qg5-rgp6-j5m5","published":"2026-11-12T20:37:38Z","modified":"2026-11-12T20:45:03.505205185Z","aliases":["CVE-2026-125327"],"summary":"pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests","details":"### Impact\n\nAn unauthenticated caller able to reach the query endpoint could exhaust database and server resources with ordinary, inexpensive requests.\n\nThe keyword-search arm read the entire corpus on every request and rebuilt an in-memory BM25 index from it, so the cost of serving a query scaled with the size of the source table rather than with the size of the result set. Each request cost the server and the tenant's database far more than it cost the caller to make, which makes this a materially more effective denial-of-service lever than flooding the endpoint with ordinary requests. The amplification factor grows with corpus size, so the largest deployments are the most exposed.\n\nHybrid search was enabled by default and configured per pipeline rather than per request, so a caller could not opt out of the keyword arm and an operator could not leave it available to some requests but not others.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint is reachable by an untrusted party. The endpoint required no authentication and applied no rate limiting.\n\nIn `1.0.0`, `internal/database/search.go:130` built the corpus query with no `LIMIT`:\n\n```go\nquery = fmt.Sprintf(`\n SELECT ...\n FROM %s%s`,\n tableIdent,\n filterClause)\n```\n\n`FetchDocuments` accepted no limit parameter at all, so neither a caller nor the orchestrator had any way to bound the read.\n`internal/config/loader.go:197` defaulted `HybridEnabled` to true, and `internal/server/middleware.go:37` applied only logging, panic recovery and optional CORS.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nReads are capped by a new per-pipeline `search.bm25_max_documents`, defaulting to 10000, plumbed through `SearchBackend.FetchDocuments` and applied as a parameterised `LIMIT`. There is deliberately no unlimited value: a non-positive setting is rejected at configuration load time rather than silently treated as unbounded.\n\nRequests that reach the cap are logged, because keyword recall is partial at that point and an operator should not have to infer it. A new `disable_hybrid` request field lets a caller skip the expensive arm per query, and can only ever turn it off.\n\n**After upgrading, review the default `search.bm25_max_documents` value of 10000 against the size of your corpus.** A cap far below corpus size silently reduces keyword recall.\n\n### Workarounds\n\nPlace the server behind an authenticating, rate-limiting reverse proxy.\n\nSetting `hybrid_enabled: false` on each pipeline removes the keyword arm and with it the unbounded read, at the cost of keyword recall. This is the only mitigation available without a proxy.\n\nNeither is a substitute for upgrading.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-rag-server","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-rag-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729020411-a09d4872356b"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125327"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-rag-server"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"}],"database_specific":{"cwe_ids":["CWE-405","CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:37:38Z","nvd_published_at":"2026-11-10T19:21:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-68g8-gh8f-7rhg","published":"2026-11-12T20:29:32Z","modified":"2026-11-12T20:45:03.499008369Z","aliases":["CVE-2026-125326"],"summary":"pgEdge RAG Server discloses part of the configured provider credential through API error messages","details":"### Impact\n\nAn unauthenticated remote caller could read part of the operator's configured LLM provider API key.\n\nThe query API relayed the text of a provider error straight to the caller. That text carried the upstream provider's own message, and providers characteristically quote a partially masked form of the credential they rejected when authentication fails — so a failing provider call published a fragment of the operator's key. A caller who can reach the endpoint can cause such a failure and read the result.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint was reachable by an untrusted party. The endpoint carries no authentication in the affected versions.\n\nThe disclosed material authenticates to a **third-party provider account** rather than to pgEdge software, which is why the severity carries Scope: Changed.\n\n`v1.0.0:internal/server/handlers.go:121` relayed `err.Error()` to the client when pipeline execution failed. `parseError` in\n`v1.0.0:internal/llm/openai/client.go` produced that error by two routes, and both disclose:\n\n```go\nvar errResp ErrorResponse\nif err := json.Unmarshal(body, &errResp); err != nil {\n return fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, string(body))\n}\nreturn fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, errResp.Error.Message)\n```\n\nThe first branch interpolates the entire unparsed response body. The second returns the provider's own message, which for OpenAI quotes the `sk-proj-` prefix and the final four characters of the submitted key.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nThe fix adds `internal/safeerr` and stops provider error text reaching API clients.\n\n**Upgrading does not undo the disclosure, and this needs action beyond upgrading. Rotate any LLM provider credential that was configured on an affected version while the endpoint was reachable by an untrusted caller**, particularly if that provider was rejecting the key at the time. A fragment already disclosed stays disclosed.\n\n### Workarounds\n\nPlace the server behind a proxy that rewrites 5xx response bodies, or terminate provider errors before they reach the API surface. Keeping provider credentials valid, so that no authentication failure is produced, also avoids the disclosure in practice.\n\nNone of these removes the underlying defect, and none is a substitute for upgrading.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-rag-server","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-rag-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729022402-72e0785a6d7c"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125326"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/pull/45"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-rag-server"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"}],"database_specific":{"cwe_ids":["CWE-209","CWE-522"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:29:32Z","nvd_published_at":"2026-11-10T18:17:34Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-8835-xmqj-354h","published":"2026-11-12T19:32:36Z","modified":"2026-11-12T19:45:03.182304314Z","aliases":["CVE-2026-125328"],"summary":"pgEdge Go LLM Library discloses provider API key fragments in error messages","details":"### Impact\n\nAn unauthenticated caller could read part of the operator's configured LLM provider API key.\n\nThe library's own health handler pings every configured provider using the operator's real credential and returns the resulting error text verbatim. Providers characteristically quote a partially masked form of the credential they rejected, so a failing ping published a fragment of\nthe key.\n\n**The endpoint is unauthenticated by default.** `authorize()` returns\ntrue immediately when the consuming application sets no `Authorize` hook,\nso `GET /v1/health` is reachable by anyone who can reach the listening\nport unless the consumer opted in to authentication.\n\n**Who is affected:** any application embedding pgedge-go-llm-lib at\n`0.1.0` or `0.1.1` that exposes the bundled HTTP proxy without setting an\n`Authorize` hook. Both affected versions are released tags and resolve\nthrough the public Go module proxy.\n\nThe disclosed material authenticates to a **third-party provider\naccount** rather than to pgEdge software, which is why the severity\ncarries Scope: Changed.\n\nEvidence at `v0.1.1`: `llm/proxy/handlers.go:296` (`handleHealth`\nreturning `err.Error()` in `ProviderHealth.Error`), `llm/proxy/proxy.go:247`\n(`authorize()` defaulting to permit), and `llm/proxy/proxy.go:350`\n(`writeError` writing the error with no redaction).\n\n### Patches\n\n**Fixed in `0.2.0`. Upgrade to `0.2.0` or later**, which redacts\ncredentials from provider error messages unconditionally. The fix adds\n`llm/internal/redact`, with a follow-up anchoring word boundaries, and is\npinned by tests in that package.\n\n**Note the version.** There is no `0.1.2` — it was never cut, and some\nearlier material named it in error. `0.2.0` is the first fixed release.\n\n**Upgrading does not undo a disclosure that already happened. Rotate any\nLLM provider credential configured on an affected version** where the\nproxy was reachable without an `Authorize` hook, particularly if a\nprovider was rejecting that key at the time.\n\n### Workarounds\n\nSet an `Authorize` hook on the proxy, which closes the unauthenticated\nroute to the health endpoint. Restricting network access to the listening\nport limits who can reach it. Neither removes the underlying disclosure\nfor a caller who does reach the endpoint.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-go-llm-lib","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-go-llm-lib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.2-0.20260729024727-7531a55d368b"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125328"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/pull/26"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-go-llm-lib"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0"}],"database_specific":{"cwe_ids":["CWE-209","CWE-522"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T19:32:36Z","nvd_published_at":"2026-11-10T19:21:10Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-vq9p-w6wv-cr25","published":"2026-11-12T20:46:03Z","modified":"2026-11-12T21:00:03.623455832Z","aliases":["CVE-2026-125323"],"summary":"pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections","details":"### Summary\n\nEvery `pg_hba.conf` generated by the pgEdge Control Plane begins with a hard-coded block of `trust` entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential.\n\n### Details\n\nThe generated file opens with the following six entries:\n\n```\nlocal all all trust\nhost all all 127.0.0.1/32 trust\nhost all all ::1/128 trust\nlocal replication all trust\nhost replication all 127.0.0.1/32 trust\nhost replication all ::1/128 trust\n```\n\nPostgres evaluates `pg_hba.conf` top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them — including entries supplied by an operator through the `pg_hba_conf` field of a database node specification, which are appended lower in the file and are therefore never reached for local or loopback connections.\n\nBoth supported orchestrators emit these entries, but exposure differs by deployment model:\n\n* **systemd** — the database runs on a shared multi-user host. Any local account\n on that host can connect as the Postgres superuser. This is the\n higher-severity case and the one the CVSS score below reflects.\n* **Docker Swarm** — the Unix socket and the loopback interface belong to the\n Postgres container, so reaching these entries requires code execution inside\n that container. Publishing the Postgres port to the host does not change this:\n such connections are not seen by Postgres as originating from `127.0.0.1` or\n `::1`, so they do not match the entries above. The practical exposure is\n correspondingly narrower.\n\nAn operator who verifies their own deployment can confirm the issue by inspecting the generated `pg_hba.conf` on a database node for the entries above.\n\n### Impact\n\nAn unprivileged local operating-system account on an affected database host obtains full control of every Postgres database on that host: read of all data, modification or destruction of all data, and any action available to a Postgres superuser. Under the systemd orchestrator this converts any local account into a database superuser with no additional prerequisites.\n\n### Affected versions\n\npgEdge Control Plane v0.1.0 through v0.10.1, inclusive.\n\n### Patches\n\nFixed in **v0.11.0**. Generated `pg_hba.conf` files no longer contain `trust` entries, and operator-supplied local authentication rules take effect. Upgrading to v0.11.0 or later is the recommended and, on v0.9.0 and later, the only complete remedy.\n\n### Workarounds\n\nThe available mitigation differs by version, and no mitigation is complete on current releases.\n\n**v0.1.0 – v0.8.1.** An operator could take the authentication files out of Patroni's control entirely: copy the generated `pg_hba.conf` and `pg_ident.conf`, edit the copies, and point the `hba_file` and `ident_file` settings at them through node-level `postgresql_conf`. This is effective but must be repeated per instance, including for every node added afterwards.\n\n**v0.9.0 – v0.10.1.** The above no longer applies. API validation rejects the `hba_file` and `ident_file` settings, and entries supplied through the `pg_hba_conf` specification array are appended below the hard-coded block rather than overriding it, so they do not take effect for local or loopback connections. The only partial mitigation available is to restrict the Unix socket: set `unix_socket_permissions` to `0700`, or to `0770` with the intended accounts placed in the `postgres` group. **This closes the socket path only. No supported configuration closes the loopback path on these versions.** Operators on v0.9.0 – v0.10.1 should upgrade to v0.11.0.","affected":[{"package":{"name":"github.com/pgEdge/control-plane","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/control-plane"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.10.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125323"},{"type":"WEB","url":"https://github.com/pgEdge/control-plane/pull/470"},{"type":"WEB","url":"https://github.com/pgEdge/contLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-w437-9mwm-j6vq","published":"2026-11-12T19:42:07Z","modified":"2026-11-12T19:45:03.186145298Z","aliases":["CVE-2026-125325"],"summary":"pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests","details":"### Impact\n\nDocuments belonging to one caller could be returned to another. Where an application passes a customer or tenant identifier as a search filter, that scoping could be defeated by ordinary concurrent traffic. **No injection and no malformed input are required** — normal load is enough.\n\nThe BM25 keyword index was a single per-pipeline object shared by every request. A request cleared it, refilled it from its own filtered corpus and then searched it, taking a separate lock for each step rather than holding the sequence as a unit. Concurrent requests therefore interleaved, and a search could run against a corpus that a different request's filter had populated.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, that serves concurrent queries — most acutely those relying on a search filter to separate tenants or customers. The query endpoint is unauthenticated in the affected versions (`internal/server/middleware.go:37` applies logging, panic recovery and optional CORS only), so both the party whose results leak and the party receiving them are anonymous remote callers.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nThe index is now built per request rather than shared. The regression is pinned by `TestSearch_ConcurrentRequestsDoNotShareKeywordIndex` in `internal/pipeline/orchestrator_test.go`.\n\n**Upgrading does not tell a developer whether or not their application affected, and needs action beyond upgrading.** If a consuminag application scopes results by tenant, treat responses served under concurrent load on any affected version as potentially having included another tenant's documents. **Affected responses cannot be identified from the server's own logs**, so there is no retrospective check available.\n\n### Workarounds\n\nSet `hybrid_enabled: false` on the pipeline, which skips the keyword arm and with it the shared index. Callers can also pass `disable_hybrid` per request, which can only ever turn the arm off.\n\nNeither is a substitute for upgrading.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-rag-server","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-rag-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729020411-a09d4872356b"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125325"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-rag-server"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"}],"database_specific":{"cwe_ids":["CWE-362","CWE-488"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T19:42:07Z","nvd_published_at":"2026-11-10T18:17:33Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"GHSA-w6c6-c85g-mmv6","published":"2026-04-08T00:15:44Z","modified":"2026-09-10T03:51:03.642188195Z","aliases":["BIT-cosign-2026-39395","CVE-2026-39395","GO-2026-5694"],"summary":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","details":"## Description\n\n`cosign verify-blob-attestation` may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.\n\n## Impact\n\nWhen `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.\n\n## Patches\n\nv3.0.6, v2.6.3\n\n## Workarounds\n\nAlways set `--check-claims=true` for attestation verification.","affected":[{"package":{"name":"github.com/sigstore/cosign","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}},{"package":{"name":"github.com/sigstore/cosign","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395"},{"type":"PACKAGE","url":"https://github.com/sigstore/cosign"}],"database_specific":{"cwe_ids":["CWE-754"],"github_reviewed":true,"github_reviewed_at":"2026-04-08T00:15:44Z","nvd_published_at":"2026-04-07T20:16:33Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}
|
||||
{"schema_version":"1.9.2","id":"GHSA-w6c6-c85g-mmv6","published":"2026-04-08T00:15:44Z","modified":"2026-11-12T18:30:04.016897487Z","aliases":["BIT-cosign-2026-39395","CVE-2026-39395","GO-2026-5694"],"summary":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","details":"## Description\n\n`cosign verify-blob-attestation` may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.\n\n## Impact\n\nWhen `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.\n\n## Patches\n\nv3.0.6, v2.6.3\n\n## Workarounds\n\nAlways set `--check-claims=true` for attestation verification.","affected":[{"package":{"name":"github.com/sigstore/cosign/v3","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}},{"package":{"name":"github.com/sigstore/cosign/v2","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}},{"package":{"name":"github.com/sigstore/cosign","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.13.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395"},{"type":"WEB","url":"https://github.com/sigstore/cosign/pull/4801"},{"type":"WEB","url":"https://github.com/sigstore/cosign/commit/f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f"},{"type":"PACKAGE","url":"https://github.com/sigstore/cosign"},{"type":"WEB","url":"https://github.com/sigstore/cosign/releases/tag/v2.6.3"},{"type":"WEB","url":"https://github.com/sigstore/cosign/releases/tag/v3.0.6"}],"database_specific":{"cwe_ids":["CWE-754"],"github_reviewed":true,"github_reviewed_at":"2026-04-08T00:15:44Z","nvd_published_at":"2026-04-07T20:16:33Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"GHSA-78fc-9688-w8xw","published":"2026-05-04T17:39:31Z","modified":"2026-05-08T19:34:46.952898Z","aliases":["CVE-2026-40076"],"summary":"OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)","details":"## Affected Versions\n\nversion ≤ 2.7.8 (latest version at time of disclosure)\n\nhttps://github.com/openmrs/openmrs-core\n\n## Impact\n\nThe endpoint `POST /openmrs/ws/rest/v1/module` is vulnerable to a path traversal (Zip Slip) attack. An authenticated attacker can upload a crafted `.omod` archive containing ZIP entries with directory traversal sequences. Upon automatic extraction by the server, the incomplete path validation in `WebModuleUtil.startModule()` fails to prevent entries such as `web/module/../../../../malicious.jsp` from being written outside the intended module directory. If the traversal target falls within the web application root (e.g., `/usr/local/tomcat/webapps/openmrs/`), the attacker achieves arbitrary file write and subsequent Remote Code Execution.\n\nNotably, other extraction methods in the same codebase (`ModuleUtil.expandJar()`, `TestInstallUtil.addZippedTestModules()`) are properly protected with `normalize().startsWith()` checks — this vulnerability is an oversight where the same fix was not applied.\n\nFurthermore, the `module.allow_web_admin` runtime property, which is intended to restrict administrators from managing modules via the web interface, only gates the Legacy UI controller entry point. The REST API endpoint `POST /openmrs/ws/rest/v1/module` does not check this property, allowing this restriction to be fully bypassed.\n\n## Steps to Reproduce\n\n1. Construct a malicious `.omod` file (which is a ZIP/JAR archive) containing a ZIP entry with a path traversal payload in its entry name, such as `web/module/../../../../<target_filename>`. Upload this file to `POST /openmrs/ws/rest/v1/module` with valid admin credentials via Basic Auth.\n\n<img width=\"1986\" height=\"1102\" alt=\"image\" src=\"https://github.com/user-attachments/assets/647f15de-7e8c-40b9-aba9-d4db5d2e0b52\" />\n\n<img width=\"2048\" height=\"1078\" alt=\"image\" src=\"https://github.com/user-attachments/assets/301412a0-e3b0-4afb-91c2-e9739de3080d\" />\n\n\n2. The server parses and loads the module. During `WebModuleUtil.startModule()`, entries under `web/module/` are automatically extracted. The existing check `Paths.get(name).startsWith(\"..\")` only blocks entries beginning with `..`, so an entry starting with `web/module/` passes the check. The `../` sequences in the remaining path cause the file to be written outside the intended `WEB-INF/view/module/` directory — for example, into the web application root at `/usr/local/tomcat/webapps/openmrs/`.\n\n<img width=\"1439\" height=\"141\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4bda3b1e-a80e-42ed-af2b-a1da53e8db03\" />\n\n3. The traversed file is now accessible under the web application root. If the written file is a JSP script, accessing it via the browser triggers server-side execution, achieving RCE.\n\n<img width=\"1482\" height=\"300\" alt=\"image\" src=\"https://github.com/user-attachments/assets/61936002-78cd-4203-80f0-f0a8702b216c\" />\n\n## Root Cause Analysis\n\nThe vulnerability exists in `WebModuleUtil.startModule()` (`web/src/main/java/org/openmrs/module/web/WebModuleUtil.java`).\n\n### Vulnerable code:\n\n```java\nEnumeration<JarEntry> entries = jarFile.entries();\nwhile (entries.hasMoreElements()) {\n JarEntry entry = entries.nextElement();\n String name = entry.getName();\n\n // ❌ Incomplete check — only blocks entries starting with \"..\"\n if (Paths.get(name).startsWith(\"..\")) {\n throw new UnsupportedOperationException(\"...\");\n }\n\n if (name.startsWith(\"web/module/\")) {\n String filepath = name.substring(11);\n StringBuilder absPath = new StringBuilder(realPath + \"/WEB-INF\");\n absPath.append(\"/view/module/\");\n absPath.append(mod.getModuleIdAsPath()).append(\"/\").append(filepath);\n\n // ❌ No normalize() or startsWith() boundary check before writing\n File outFile = new File(absPath.toString().replace(\"/\", File.separator));\n outStream = new FileOutputStream(outFile, false);\n inStream = jarFile.getInputStream(entry);\n OpenmrsUtil.copyFile(inStream, outStream);\n }\n}\n```\n\n**Why the check fails:** For an entry named `web/module/foo/../../../../evil.jsp`, `Paths.get(name)` starts with `web`, not `..`, so the check passes. After `name.substring(11)`, the filepath `foo/../../../../evil.jsp` is concatenated directly into the output path without normalization, resulting in a write outside the intended directory.\n\n### Correctly protected code in the same codebase:\n\n**`ModuleUtil.expandJar()`:**\n\n```java\n// ✅ Correct — uses normalize().startsWith()\nif (!parent.toPath().normalize().startsWith(docBase)) {\n throw new UnsupportedOperationException(\"Line truncated
|
||||
{"schema_version":"1.9.2","id":"GHSA-78fc-9688-w8xw","published":"2026-05-04T17:39:31Z","modified":"2026-11-12T18:30:04.206018107Z","aliases":["CVE-2026-40076"],"summary":"OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)","details":"## Affected Versions\n\nversion ≤ 2.7.8 (latest version at time of disclosure)\n\nhttps://github.com/openmrs/openmrs-core\n\n## Impact\n\nThe endpoint `POST /openmrs/ws/rest/v1/module` is vulnerable to a path traversal (Zip Slip) attack. An authenticated attacker can upload a crafted `.omod` archive containing ZIP entries with directory traversal sequences. Upon automatic extraction by the server, the incomplete path validation in `WebModuleUtil.startModule()` fails to prevent entries such as `web/module/../../../../malicious.jsp` from being written outside the intended module directory. If the traversal target falls within the web application root (e.g., `/usr/local/tomcat/webapps/openmrs/`), the attacker achieves arbitrary file write and subsequent Remote Code Execution.\n\nNotably, other extraction methods in the same codebase (`ModuleUtil.expandJar()`, `TestInstallUtil.addZippedTestModules()`) are properly protected with `normalize().startsWith()` checks — this vulnerability is an oversight where the same fix was not applied.\n\nFurthermore, the `module.allow_web_admin` runtime property, which is intended to restrict administrators from managing modules via the web interface, only gates the Legacy UI controller entry point. The REST API endpoint `POST /openmrs/ws/rest/v1/module` does not check this property, allowing this restriction to be fully bypassed.\n\n## Steps to Reproduce\n\n1. Construct a malicious `.omod` file (which is a ZIP/JAR archive) containing a ZIP entry with a path traversal payload in its entry name, such as `web/module/../../../../<target_filename>`. Upload this file to `POST /openmrs/ws/rest/v1/module` with valid admin credentials via Basic Auth.\n\n<img width=\"1986\" height=\"1102\" alt=\"image\" src=\"https://github.com/user-attachments/assets/647f15de-7e8c-40b9-aba9-d4db5d2e0b52\" />\n\n<img width=\"2048\" height=\"1078\" alt=\"image\" src=\"https://github.com/user-attachments/assets/301412a0-e3b0-4afb-91c2-e9739de3080d\" />\n\n\n2. The server parses and loads the module. During `WebModuleUtil.startModule()`, entries under `web/module/` are automatically extracted. The existing check `Paths.get(name).startsWith(\"..\")` only blocks entries beginning with `..`, so an entry starting with `web/module/` passes the check. The `../` sequences in the remaining path cause the file to be written outside the intended `WEB-INF/view/module/` directory — for example, into the web application root at `/usr/local/tomcat/webapps/openmrs/`.\n\n<img width=\"1439\" height=\"141\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4bda3b1e-a80e-42ed-af2b-a1da53e8db03\" />\n\n3. The traversed file is now accessible under the web application root. If the written file is a JSP script, accessing it via the browser triggers server-side execution, achieving RCE.\n\n<img width=\"1482\" height=\"300\" alt=\"image\" src=\"https://github.com/user-attachments/assets/61936002-78cd-4203-80f0-f0a8702b216c\" />\n\n## Root Cause Analysis\n\nThe vulnerability exists in `WebModuleUtil.startModule()` (`web/src/main/java/org/openmrs/module/web/WebModuleUtil.java`).\n\n### Vulnerable code:\n\n```java\nEnumeration<JarEntry> entries = jarFile.entries();\nwhile (entries.hasMoreElements()) {\n JarEntry entry = entries.nextElement();\n String name = entry.getName();\n\n // ❌ Incomplete check — only blocks entries starting with \"..\"\n if (Paths.get(name).startsWith(\"..\")) {\n throw new UnsupportedOperationException(\"...\");\n }\n\n if (name.startsWith(\"web/module/\")) {\n String filepath = name.substring(11);\n StringBuilder absPath = new StringBuilder(realPath + \"/WEB-INF\");\n absPath.append(\"/view/module/\");\n absPath.append(mod.getModuleIdAsPath()).append(\"/\").append(filepath);\n\n // ❌ No normalize() or startsWith() boundary check before writing\n File outFile = new File(absPath.toString().replace(\"/\", File.separator));\n outStream = new FileOutputStream(outFile, false);\n inStream = jarFile.getInputStream(entry);\n OpenmrsUtil.copyFile(inStream, outStream);\n }\n}\n```\n\n**Why the check fails:** For an entry named `web/module/foo/../../../../evil.jsp`, `Paths.get(name)` starts with `web`, not `..`, so the check passes. After `name.substring(11)`, the filepath `foo/../../../../evil.jsp` is concatenated directly into the output path without normalization, resulting in a write outside the intended directory.\n\n### Correctly protected code in the same codebase:\n\n**`ModuleUtil.expandJar()`:**\n\n```java\n// ✅ Correct — uses normalize().startsWith()\nif (!parent.toPath().normalize().startsWith(docBase)) {\n throw new UnsupportedOperationExceptionLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-2f3w-v7f5-vpgx","published":"2026-11-10T21:33:09Z","modified":"2026-11-12T17:28:50.500250748Z","withdrawn":"2026-11-12T17:17:35Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-4g86-54fm-h9h8. This link is maintained to preserve external references.\n\n## Original Description\nMissing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.","affected":[{"package":{"name":"Aspire.Dashboard.Sdk.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118740"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118740"}],"database_specific":{"cwe_ids":["CWE-862"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T17:17:35Z","nvd_published_at":"2026-11-10T19:19:50Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-4g86-54fm-h9h8","published":"2026-11-12T17:17:48Z","modified":"2026-11-12T17:30:43.016211419Z","aliases":["CVE-2026-118740"],"summary":"Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.\n\nAspire Dashboard's unauthenticated NotFound route can permit telemetry deletion in both standalone and AppHost-hosted deployments. In standalone deployments using browser-token authentication, it can also expose the browser token.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/526\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Critical\n- **Score:** 9.1\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`\n- **Weakness:** CWE-862\n\n## Affected Platforms\n\n- **Platforms:** Any supported OS\n- **Architectures:** x64, Arm64\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\n### Standalone Aspire Dashboard\n\nPackage | Affected version | Patched version\n--- | --- | ---\nAspire Dashboard | < 13.6.5 | 13.6.5\n\nBoth 13.6.3 and 13.6.4 contain the unauthenticated NotFound route.\n\n### Aspire Dashboard SDK packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Aspire.Dashboard.Sdk.linux-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.linux-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-arm64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.linux-musl-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-musl-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.osx-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.osx-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.osx-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.osx-arm64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.win-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.win-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.win-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.win-arm64) | < 13.6.5 | 13.6.5\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nAspire Dashboard releases through 13.6.4 are affected, whether deployed independently or launched by an Aspire AppHost. For an AppHost using Dashboard SDK packages, check the resolved Aspire.Dashboard.Sdk package versions against the affected ranges above. If the AppHost selects a CLI-bundled Dashboard or a custom Dashboard path, check the version of that Dashboard instead. Aspire ships independently of .NET; installing a .NET runtime or SDK update does not replace the Dashboard.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nUpdate Aspire Dashboard to version 13.6.5 or later. Neither 13.6.3 nor 13.6.4 is a fixed upgrade target.\n\nFor container deployments, explicitly set the Dashboard image to `mcr.microsoft.com/aspire/dashboard:13.6.5` and recreate or redeploy the container. Replace older version tags and nightly image references, including those in generated Docker Compose or Kubernetes manifests, with this fixed stable image. Updating AppHost package references alone does not replace an image reference in an existing deployment manifest.\n\nFor an AppHost using Dashboard SDK packages, update any explicit Aspire.Hosting.AppHost version, including a central package version, to 13.6.5 or later. If that reference is supplied implicitly by Aspire.AppHost.Sdk, update the SDK reference to 13.6.5 or later instead. Restore and rebuild the AppHost, verify that its resolved Aspire.Dashboard.Sdk packages are 13.6.5 or later, and restart the AppHost to run the updated Dashboard.\n\nIf your AppHost selects a CLI-bundled Dashboard or a custom Dashboard path, update the Dashboard in that selected bundle or location to 13.6.5 or later and restart the AppHost. Updating AppHost package references alone does not replace that Dashboard.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the Aspire repository at https://github.com/microsoft/aspire. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2021-1070","published":"2021-07-29T00:01:10.187569Z","modified":"2026-11-11T14:30:03.340554694Z","summary":"Heap-buffer-overflow in ZSTD_decompressBlock_internal","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nZSTD_decompressBlock_internal\nZSTD_decompressMultiFrame\nZSTD_decompressDCtx\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"861ba79f31393dec0a0782ca11cf32cebb6f6610"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1070.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2021-1070","published":"2021-07-29T00:01:10.187569Z","modified":"2026-11-12T14:30:06.030965700Z","summary":"Heap-buffer-overflow in ZSTD_decompressBlock_internal","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nZSTD_decompressBlock_internal\nZSTD_decompressMultiFrame\nZSTD_decompressDCtx\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"861ba79f31393dec0a0782ca11cf32cebb6f6610"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1070.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2021-1086","published":"2021-08-02T00:00:31.888461Z","modified":"2026-11-11T14:30:03.211606649Z","summary":"Heap-buffer-overflow in dwg_convert_SAB_to_SAT1","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728\n\n```\nCrash type: Heap-buffer-overflow READ 2\nCrash state:\ndwg_convert_SAB_to_SAT1\ndxf_3dsolid\ndwg_dxf_REGION_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"629cbbdcebd7f5751ddb72eacf8f3e1a5b854e2b"}]}],"versions":["0.12.3.4264","0.12.3.4267","0.12.3.4270","0.12.3.4273","0.12.3.4280","0.12.4","0.12.4.4288","0.12.4.4296","0.12.4.4298","0.12.4.4300","0.12.4.4302","0.12.4.4307","0.12.4.4313","0.12.4.4317","0.12.4.4321","0.12.4.4324","0.12.4.4331","0.12.4.4338","0.12.4.4343","0.12.4.4348","0.12.4.4362","0.12.4.4364","0.12.4.4367","0.12.4.4287","0.12.4.4368","0.12.4.4375","0.12.4.4378","0.12.4.4382","0.12.4.4384","0.12.4.4387","0.12.4.4390","0.12.4.4393","0.12.5-pre","0.12.4.4395","0.12.4.4398","0.12.4.4399","0.12.4.4400","0.12.4.4402","0.12.5","0.12.4.4403","0.12.4.4404","0.12.4.4409","0.12.4.4415","0.12.4.4420","0.12.4.4423","0.12.4.4425","0.12.4.4430","0.12.4.4437","0.12.4.4442","0.12.4.4444","0.12.4.4462","0.12.4.4466","0.12.4.4467","0.12.4.4475","0.12.4.4487","0.12.4.4491","0.12.4.4492","0.12.4.4494","0.12.4.4497","0.12.4.4507","0.12.4.4515","0.12.4.4517","0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2021-1086","published":"2021-08-02T00:00:31.888461Z","modified":"2026-11-12T14:30:05.617764981Z","summary":"Heap-buffer-overflow in dwg_convert_SAB_to_SAT1","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728\n\n```\nCrash type: Heap-buffer-overflow READ 2\nCrash state:\ndwg_convert_SAB_to_SAT1\ndxf_3dsolid\ndwg_dxf_REGION_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"629cbbdcebd7f5751ddb72eacf8f3e1a5b854e2b"}]}],"versions":["0.12.3.4264","0.12.3.4267","0.12.3.4270","0.12.3.4273","0.12.3.4280","0.12.4","0.12.4.4288","0.12.4.4296","0.12.4.4298","0.12.4.4300","0.12.4.4302","0.12.4.4307","0.12.4.4313","0.12.4.4317","0.12.4.4321","0.12.4.4324","0.12.4.4331","0.12.4.4338","0.12.4.4343","0.12.4.4348","0.12.4.4362","0.12.4.4364","0.12.4.4367","0.12.4.4287","0.12.4.4368","0.12.4.4375","0.12.4.4378","0.12.4.4382","0.12.4.4384","0.12.4.4387","0.12.4.4390","0.12.4.4393","0.12.5-pre","0.12.4.4395","0.12.4.4398","0.12.4.4399","0.12.4.4400","0.12.4.4402","0.12.5","0.12.4.4403","0.12.4.4404","0.12.4.4409","0.12.4.4415","0.12.4.4420","0.12.4.4423","0.12.4.4425","0.12.4.4430","0.12.4.4437","0.12.4.4442","0.12.4.4444","0.12.4.4462","0.12.4.4466","0.12.4.4467","0.12.4.4475","0.12.4.4487","0.12.4.4491","0.12.4.4492","0.12.4.4494","0.12.4.4497","0.12.4.4507","0.12.4.4515","0.12.4.4517","0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2021-1672","published":"2021-12-12T00:01:29.747137Z","modified":"2026-11-11T14:30:03.341943960Z","summary":"Heap-buffer-overflow in blosc_d","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nblosc_d\ndo_job\nblosc_run_decompression_with_context\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1672.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2021-1672","published":"2021-12-12T00:01:29.747137Z","modified":"2026-11-12T14:30:05.281210139Z","summary":"Heap-buffer-overflow in blosc_d","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nblosc_d\ndo_job\nblosc_run_decompression_with_context\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1672.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1134","published":"2022-11-04T00:02:11.463429Z","modified":"2026-11-11T14:30:03.340465029Z","summary":"Heap-buffer-overflow in ndlz8_decompress","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nndlz8_decompress\nblosc_d\ndo_job\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"1c9795f2e3e04a79f13d9e7658e6d6e47dfe1cc4"}]}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2022-1134.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1134","published":"2022-11-04T00:02:11.463429Z","modified":"2026-11-12T14:30:04.156546976Z","summary":"Heap-buffer-overflow in ndlz8_decompress","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nndlz8_decompress\nblosc_d\ndo_job\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"1c9795f2e3e04a79f13d9e7658e6d6e47dfe1cc4"}]}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2022-1134.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1176","published":"2022-11-18T13:00:26.857477Z","modified":"2026-11-11T14:30:03.225734879Z","summary":"Heap-double-free in dwg_free","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53483\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free\nllvmfuzz.c\ndwg_free\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"2d4a473b670848fe9aac2fde249964d1ed9ba97e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1176","published":"2022-11-18T13:00:26.857477Z","modified":"2026-11-12T14:30:06.189452477Z","summary":"Heap-double-free in dwg_free","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53483\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free\nllvmfuzz.c\ndwg_free\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"2d4a473b670848fe9aac2fde249964d1ed9ba97e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1198","published":"2022-11-23T13:02:06.623044Z","modified":"2026-11-11T14:45:02.962738412Z","summary":"Heap-buffer-overflow in dwg_json_LTYPE","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53617\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_json_LTYPE\njson_objects_write\ndwg_write_json\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"580e8bbebf18579b97e2c20b032368b9079624ca"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1198","published":"2022-11-23T13:02:06.623044Z","modified":"2026-11-12T14:30:04.366030564Z","summary":"Heap-buffer-overflow in dwg_json_LTYPE","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53617\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_json_LTYPE\njson_objects_write\ndwg_write_json\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"580e8bbebf18579b97e2c20b032368b9079624ca"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1259","published":"2022-12-13T13:00:46.870838Z","modified":"2026-11-11T14:45:03.811584307Z","summary":"Heap-buffer-overflow in dwg_decode_INSERT_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ndwg_decode_INSERT_private\ndwg_decode_INSERT\ndwg_decode_add_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7a44f5e43b2a49bf244e24b796a657c9c78f31a1"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1259","published":"2022-12-13T13:00:46.870838Z","modified":"2026-11-12T14:30:04.362441034Z","summary":"Heap-buffer-overflow in dwg_decode_INSERT_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ndwg_decode_INSERT_private\ndwg_decode_INSERT\ndwg_decode_add_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7a44f5e43b2a49bf244e24b796a657c9c78f31a1"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1277","published":"2023-06-26T14:01:01.876870Z","modified":"2026-11-10T14:30:05.710184962Z","summary":"Heap-use-after-free in mk_event_timeout_destroy","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089\n\n```\nCrash type: Heap-use-after-free WRITE 8\nCrash state:\nmk_event_timeout_destroy\nflb_sched_destroy\nflb_config_exit\n```\n","affected":[{"package":{"name":"fluent-bit","ecosystem":"OSS-Fuzz","purl":"pkg:generic/fluent-bit"},"ranges":[{"type":"GIT","repo":"https://github.com/fluent/fluent-bit/","events":[{"introduced":"0c5d8da6bbf32d4712d4dd718155ac2301b1bb17"},{"introduced":"73bc3ec78451aa41757bf7a12366228b79527544"}]}],"versions":["tiger-2.0.9-dev-20230104","v2.0.0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.0.0pre","v2.0.1","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9","v2.1.0","v2.1.0-rc1","v2.1.0-rc2","v2.1.1","v2.1.10","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.5-windows-artifact-fix","v2.1.6","v2.1.7","v2.1.8","v2.1.9","vv.2.0.7","v2.2.0","v2.2.1","v2.2.2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v2.2.3","v3.0.5","v3.0.6","v3.0.7","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.1.10","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.2.10","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.0.10","v4.0.11","v4.1.0","v4.0.12","v4.1.1","v4.0.13","v4.2.0","v4.2.1","v4.2.2","v5.0.0-dev-20260228","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.2","v5.1.3","v5.1.4","v5.1.5","wasm-browser-e090fbd054c82ae67f12ebe926600827b6cf5f48","wasm-browser-364a2d700a05893618527fff8d4d1f9e5e2e35cd","wasm-browser-41dcc3d1f91a758921a2b995e7f249905c776277","wasm-browser-78911a0ff0594a2198235a96d6048d72909ff041","wasm-browser-85c7030b29c4a9702fa0229efd9eb71736e03038","wasm-browser-a0c6ac530896994398822df052015582e3830243","wasm-browser-a88af96c92534e1bb0d585f63e97e41cd543a059","wasm-browser-28ebf30c97d5bcb9ac6e3af3794023f1ebc92543","wasm-browser-9c04b3bcfcb50a036692ab30f2added0cb682215","wasm-browser-f6c314476f1fc9d6aac2bff1154a33a40a8a721a","wasm-browser-fc966e90da4d99afc36bee42e3ac444dcab9372e","v5.2.0","wasm-browser-8590ef6a819e36b84ee14ae325f46ea10b3ef852","wasm-browser-e0149076aeff009d35fd495e55379cb78f1eb53f","wasm-browser-d9464c001e4ab5a17b8dac566e4f7ab25c2bcb0b","v5.0.11","v5.0.10","v4.2.8","v4.2.7","v4.2.6","v4.2.5","v4.2.4","v4.2.3","v4.2.3.1","v4.0.14","v4.1.2"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/fluent-bit/OSV-2022-1277.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-1277","published":"2023-06-26T14:01:01.876870Z","modified":"2026-11-12T14:30:04.543054874Z","summary":"Heap-use-after-free in mk_event_timeout_destroy","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089\n\n```\nCrash type: Heap-use-after-free WRITE 8\nCrash state:\nmk_event_timeout_destroy\nflb_sched_destroy\nflb_config_exit\n```\n","affected":[{"package":{"name":"fluent-bit","ecosystem":"OSS-Fuzz","purl":"pkg:generic/fluent-bit"},"ranges":[{"type":"GIT","repo":"https://github.com/fluent/fluent-bit/","events":[{"introduced":"0c5d8da6bbf32d4712d4dd718155ac2301b1bb17"},{"introduced":"73bc3ec78451aa41757bf7a12366228b79527544"}]}],"versions":["tiger-2.0.9-dev-20230104","v2.0.0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.0.0pre","v2.0.1","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9","v2.1.0","v2.1.0-rc1","v2.1.0-rc2","v2.1.1","v2.1.10","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.5-windows-artifact-fix","v2.1.6","v2.1.7","v2.1.8","v2.1.9","vv.2.0.7","v2.2.0","v2.2.1","v2.2.2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v2.2.3","v3.0.5","v3.0.6","v3.0.7","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.1.10","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.2.10","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.0.10","v4.0.11","v4.1.0","v4.0.12","v4.1.1","v4.0.13","v4.2.0","v4.2.1","v4.2.2","v5.0.0-dev-20260228","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.2","v5.1.3","v5.1.4","v5.1.5","wasm-browser-e090fbd054c82ae67f12ebe926600827b6cf5f48","wasm-browser-364a2d700a05893618527fff8d4d1f9e5e2e35cd","wasm-browser-41dcc3d1f91a758921a2b995e7f249905c776277","wasm-browser-78911a0ff0594a2198235a96d6048d72909ff041","wasm-browser-85c7030b29c4a9702fa0229efd9eb71736e03038","wasm-browser-a0c6ac530896994398822df052015582e3830243","wasm-browser-a88af96c92534e1bb0d585f63e97e41cd543a059","wasm-browser-28ebf30c97d5bcb9ac6e3af3794023f1ebc92543","wasm-browser-9c04b3bcfcb50a036692ab30f2added0cb682215","wasm-browser-f6c314476f1fc9d6aac2bff1154a33a40a8a721a","wasm-browser-fc966e90da4d99afc36bee42e3ac444dcab9372e","v5.2.0","wasm-browser-8590ef6a819e36b84ee14ae325f46ea10b3ef852","wasm-browser-e0149076aeff009d35fd495e55379cb78f1eb53f","wasm-browser-d9464c001e4ab5a17b8dac566e4f7ab25c2bcb0b","wasm-browser-f5a3cd20195a05542ec0b3e009084b0bce28ca54","v5.0.11","v5.0.10","v4.2.8","v4.2.7","v4.2.6","v4.2.5","v4.2.4","v4.2.3","v4.2.3.1","v4.0.14","v4.1.2"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/fluent-bit/OSV-2022-1277.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-372","published":"2022-04-26T00:00:09.352798Z","modified":"2026-11-11T14:45:04.039550097Z","summary":"Heap-buffer-overflow in dwg_encode_VERTEX_2D","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_encode_VERTEX_2D\ndwg_encode_add_object\ndwg_encode\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-372","published":"2022-04-26T00:00:09.352798Z","modified":"2026-11-12T14:30:04.367952623Z","summary":"Heap-buffer-overflow in dwg_encode_VERTEX_2D","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_encode_VERTEX_2D\ndwg_encode_add_object\ndwg_encode\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-379","published":"2022-04-27T00:00:44.539231Z","modified":"2026-11-11T14:30:03.222354709Z","summary":"Segv on unknown address in bit_write_TV","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014\n\n```\nCrash type: Segv on unknown address\nCrash state:\nbit_write_TV\nbit_write_T\ndwg_encode_BLOCK\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046"Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-379","published":"2022-04-27T00:00:44.539231Z","modified":"2026-11-12T14:30:05.295061106Z","summary":"Segv on unknown address in bit_write_TV","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014\n\n```\nCrash type: Segv on unknown address\nCrash state:\nbit_write_TV\nbit_write_T\ndwg_encode_BLOCK\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046"Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-388","published":"2022-05-01T00:01:54.904711Z","modified":"2026-11-11T14:45:02.965884894Z","summary":"Segv on unknown address in dwg_ref_get_object","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151\n\n```\nCrash type: Segv on unknown address\nCrash state:\ndwg_ref_get_object\ndwg_geojson_feature\ndwg_geojson_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-388","published":"2022-05-01T00:01:54.904711Z","modified":"2026-11-12T14:30:05.363352097Z","summary":"Segv on unknown address in dwg_ref_get_object","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151\n\n```\nCrash type: Segv on unknown address\nCrash state:\ndwg_ref_get_object\ndwg_geojson_feature\ndwg_geojson_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-400","published":"2022-05-08T00:00:40.782520Z","modified":"2026-11-11T14:45:02.979866453Z","summary":"Heap-double-free in dwg_free_XRECORD_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_XRECORD_private\ndwg_free_XRECORD\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"4eadb3538aee39bf0732ee5b273f414ddafa765e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116"Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-400","published":"2022-05-08T00:00:40.782520Z","modified":"2026-11-12T14:30:04.357101878Z","summary":"Heap-double-free in dwg_free_XRECORD_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_XRECORD_private\ndwg_free_XRECORD\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"4eadb3538aee39bf0732ee5b273f414ddafa765e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116"Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-608","published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-11T14:30:03.783789743Z","summary":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-608.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-608","published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-12T14:30:04.060883164Z","summary":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0","v0.13-snapshot"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-608.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-653","published":"2022-07-30T00:01:52.491112Z","modified":"2026-11-11T14:30:03.211482113Z","summary":"Heap-double-free in dwg_free_common_entity_data","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49602\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_common_entity_data\ndwg_free_DIMENSION_ANG2LN\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-653","published":"2022-07-30T00:01:52.491112Z","modified":"2026-11-12T14:30:04.360929516Z","summary":"Heap-double-free in dwg_free_common_entity_data","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49602\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_common_entity_data\ndwg_free_DIMENSION_ANG2LN\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-714","published":"2022-08-15T00:00:47.794062Z","modified":"2026-11-10T14:30:05.823322213Z","summary":"Heap-buffer-overflow in dynapi_set_helper","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194\n\n```\nCrash type: Heap-buffer-overflow WRITE 16\nCrash state:\ndynapi_set_helper\ndwg_dynapi_header_set_value\njson_HEADER\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-714","published":"2022-08-15T00:00:47.794062Z","modified":"2026-11-12T14:30:04.355338067Z","summary":"Heap-buffer-overflow in dynapi_set_helper","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194\n\n```\nCrash type: Heap-buffer-overflow WRITE 16\nCrash state:\ndynapi_set_helper\ndwg_dynapi_header_set_value\njson_HEADER\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-725","published":"2022-08-18T00:01:05.918943Z","modified":"2026-11-11T14:30:03.783986990Z","summary":"Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\njxl::N_EMU128::WriteToU8Stage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"a50e71631cabfbdd57d540ba080ecec19b4664af"}]}],"versions":["v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-725.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-725","published":"2022-08-18T00:01:05.918943Z","modified":"2026-11-12T14:30:05.299150450Z","summary":"Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\njxl::N_EMU128::WriteToU8Stage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"a50e71631cabfbdd57d540ba080ecec19b4664af"}]}],"versions":["v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0","v0.13-snapshot"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-725.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"OSV-2022-867","published":"2022-09-09T00:01:54.157712Z","modified":"2026-10-22T19:08:21.081934619Z","summary":"Heap-buffer-overflow in get_utf_8_string","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nget_utf_8_string\ndissect_form_urlencoded\ncall_dissector_work\n```\n","affected":[{"package":{"name":"wireshark","ecosystem":"OSS-Fuzz","purl":"pkg:generic/wireshark"},"ranges":[{"type":"GIT","repo":"https://gitlab.com/wireshark/wireshark.git","events":[{"introduced":"248ff020e7ea17785cc9451f6d24ad61c4310d1f"}]}],"versions":["v4.1.0","v4.1.1rc0","v4.2.0rc0","v4.3.0rc0","v4.2.0rc1","v4.2.0rc2","wireshark-4.2.0rc2","v4.2.0rc3","v4.2.0","v4.2.1rc0","wireshark-4.2.0","v4.2.1","v4.2.2rc0","wireshark-4.2.1","v4.2.2","v4.2.3rc0","wireshark-4.2.2","v4.2.3","v4.2.4rc0","wireshark-4.2.3","v4.2.4","v4.2.5rc0","wireshark-4.2.4","v4.2.5","v4.2.6rc0","wireshark-4.2.5","v4.3.0rc1","v4.2.6","v4.2.7rc0","wireshark-4.2.6","v4.3.0","v4.3.1rc0","v4.3.1","v4.3.2rc0","v4.4.0rc0","v4.5.0rc0","v4.4.0rc1","v4.2.7","v4.2.8rc0","v4.4.0","v4.4.1rc0","wireshark-4.2.7","wireshark-4.4.0","v4.2.8","v4.2.9rc0","v4.4.1","v4.4.2rc0","wireshark-4.2.8","wireshark-4.4.1","v4.2.10rc0","v4.2.9","v4.4.2","v4.4.3rc0","wireshark-4.2.9","wireshark-4.4.2","ssv0.9.0rc0","v4.2.10","v4.2.11rc0","v4.4.3","v4.4.4rc0","wireshark-4.2.10","wireshark-4.4.3","ssv0.9.0rc1","ssv0.9.0","v4.2.11","v4.2.12rc0","v4.4.4","v4.4.5rc0","wireshark-4.2.11","wireshark-4.4.4","ssv0.9.1","v4.4.5","v4.4.6rc0","wireshark-4.4.5","ssv0.9.2rc0","v4.4.6","v4.6.7rc0","wireshark-4.4.6","v4.4.7rc0","v4.2.12","v4.2.13rc0","v4.4.7","v4.4.8rc0","wireshark-4.2.12","wireshark-4.4.7","ssv0.9.2","ssv0.9.3rc0","v4.4.8","v4.4.9rc0","wireshark-4.4.8","ssv0.9.3","v4.2.13","v4.2.14rc0","v4.4.10rc0","v4.4.9","v4.6.0rc0","v4.6.0rc1","v4.7.0rc0","wireshark-4.2.13","wireshark-4.4.9","ssv0.9.4rc0","v4.2.14","v4.4.10","v4.6.0","v4.2.15rc0","v4.4.11rc0","v4.6.1rc0","v4.4.11","v4.4.12rc0","v4.6.1","v4.6.2rc0","v4.6.2","v4.6.3rc0","v4.4.12","v4.4.13rc0","v4.4.13","v4.4.14rc0","v4.6.3","v4.6.4rc0","v4.4.14","v4.4.15rc0","v4.6.4","v4.6.5rc0","v4.4.15","v4.4.16rc0","v4.6.5","v4.6.6rc0","v4.4.16","v4.4.17rc0","v4.6.6","ssv0.10.0","v4.7.0","ssv0.10.1rc0","v4.7.1rc0","ssv0.10.1","ssv0.10.2rc0","v4.7.1","v4.7.2rc0","v4.4.17","v4.4.18rc0","v4.6.7","v4.6.8rc0","ssv0.10.2","ssv0.10.3rc0","v4.7.2","v4.7.3rc0","v4.4.18","v4.4.19rc0","v4.6.8","v4.6.9rc0","ssv0.10.3","ssv0.10.4rc0","v4.7.3","v4.7.4rc0","ssv0.10.4","ssv0.10.5rc0","v4.4.19","v4.4.20rc0","v4.6.10rc0","v4.6.9","v4.7.4","v4.7.5rc0","ssv1.0.0rc0","ssv1.1.0rc0","v5.0.0rc0","v5.1.0rc0","ssv1.0.0rc1","v5.0.0rc1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wireshark/OSV-2022-867.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2022-867","published":"2022-09-09T00:01:54.157712Z","modified":"2026-11-12T15:30:29.772849237Z","summary":"Heap-buffer-overflow in get_utf_8_string","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nget_utf_8_string\ndissect_form_urlencoded\ncall_dissector_work\n```\n","affected":[{"package":{"name":"wireshark","ecosystem":"OSS-Fuzz","purl":"pkg:generic/wireshark"},"ranges":[{"type":"GIT","repo":"https://gitlab.com/wireshark/wireshark.git","events":[{"introduced":"248ff020e7ea17785cc9451f6d24ad61c4310d1f"}]}],"versions":["v4.1.0","v4.1.1rc0","v4.2.0rc0","v4.3.0rc0","v4.2.0rc1","v4.2.0rc2","wireshark-4.2.0rc2","v4.2.0rc3","v4.2.0","v4.2.1rc0","wireshark-4.2.0","v4.2.1","v4.2.2rc0","wireshark-4.2.1","v4.2.2","v4.2.3rc0","wireshark-4.2.2","v4.2.3","v4.2.4rc0","wireshark-4.2.3","v4.2.4","v4.2.5rc0","wireshark-4.2.4","v4.2.5","v4.2.6rc0","wireshark-4.2.5","v4.3.0rc1","v4.2.6","v4.2.7rc0","wireshark-4.2.6","v4.3.0","v4.3.1rc0","v4.3.1","v4.3.2rc0","v4.4.0rc0","v4.5.0rc0","v4.4.0rc1","v4.2.7","v4.2.8rc0","v4.4.0","v4.4.1rc0","wireshark-4.2.7","wireshark-4.4.0","v4.2.8","v4.2.9rc0","v4.4.1","v4.4.2rc0","wireshark-4.2.8","wireshark-4.4.1","v4.2.10rc0","v4.2.9","v4.4.2","v4.4.3rc0","wireshark-4.2.9","wireshark-4.4.2","ssv0.9.0rc0","v4.2.10","v4.2.11rc0","v4.4.3","v4.4.4rc0","wireshark-4.2.10","wireshark-4.4.3","ssv0.9.0rc1","ssv0.9.0","v4.2.11","v4.2.12rc0","v4.4.4","v4.4.5rc0","wireshark-4.2.11","wireshark-4.4.4","ssv0.9.1","v4.4.5","v4.4.6rc0","wireshark-4.4.5","ssv0.9.2rc0","v4.4.6","v4.6.7rc0","wireshark-4.4.6","v4.4.7rc0","v4.2.12","v4.2.13rc0","v4.4.7","v4.4.8rc0","wireshark-4.2.12","wireshark-4.4.7","ssv0.9.2","ssv0.9.3rc0","v4.4.8","v4.4.9rc0","wireshark-4.4.8","ssv0.9.3","v4.2.13","v4.2.14rc0","v4.4.10rc0","v4.4.9","v4.6.0rc0","v4.6.0rc1","v4.7.0rc0","wireshark-4.2.13","wireshark-4.4.9","ssv0.9.4rc0","v4.2.14","v4.4.10","v4.6.0","v4.2.15rc0","v4.4.11rc0","v4.6.1rc0","v4.4.11","v4.4.12rc0","v4.6.1","v4.6.2rc0","v4.6.2","v4.6.3rc0","v4.4.12","v4.4.13rc0","v4.4.13","v4.4.14rc0","v4.6.3","v4.6.4rc0","v4.4.14","v4.4.15rc0","v4.6.4","v4.6.5rc0","v4.4.15","v4.4.16rc0","v4.6.5","v4.6.6rc0","v4.4.16","v4.4.17rc0","v4.6.6","ssv0.10.0","v4.7.0","ssv0.10.1rc0","v4.7.1rc0","ssv0.10.1","ssv0.10.2rc0","v4.7.1","v4.7.2rc0","v4.4.17","v4.4.18rc0","v4.6.7","v4.6.8rc0","ssv0.10.2","ssv0.10.3rc0","v4.7.2","v4.7.3rc0","v4.4.18","v4.4.19rc0","v4.6.8","v4.6.9rc0","ssv0.10.3","ssv0.10.4rc0","v4.7.3","v4.7.4rc0","ssv0.10.4","ssv0.10.5rc0","v4.4.19","v4.4.20rc0","v4.6.10rc0","v4.6.9","v4.7.4","v4.7.5rc0","ssv1.0.0rc0","ssv1.1.0rc0","v5.0.0rc0","v5.1.0rc0","ssv1.0.0rc1","v5.0.0rc1","ssv1.0.0rc2","v5.0.0rc2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wireshark/OSV-2022-867.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-1350","published":"2023-12-23T00:12:38.562149Z","modified":"2026-11-11T14:45:02.966375985Z","summary":"Heap-buffer-overflow in inflate","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ninflate\nuncompress2\nuncompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"e6035df1d3f285af9a2e756fb428633eb7898881"}]}],"versions":["v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-1350.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-1350","published":"2023-12-23T00:12:38.562149Z","modified":"2026-11-12T14:30:05.383500188Z","summary":"Heap-buffer-overflow in inflate","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ninflate\nuncompress2\nuncompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"e6035df1d3f285af9a2e756fb428633eb7898881"}]}],"versions":["v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-1350.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-307","published":"2023-04-13T14:02:09.774988Z","modified":"2026-11-11T14:45:03.795060395Z","summary":"Heap-buffer-overflow in bit_read_BB","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57911\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nbit_read_BB\ndwg_decode_entity\ndwg_decode_OLE2FRAME_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"9d068534eb093790d9be1b8aa8ed47cafc7f2285"}]}],"versions":["0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.61Line truncated
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-307","published":"2023-04-13T14:02:09.774988Z","modified":"2026-11-12T14:30:05.528845520Z","summary":"Heap-buffer-overflow in bit_read_BB","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57911\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nbit_read_BB\ndwg_decode_entity\ndwg_decode_OLE2FRAME_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"9d068534eb093790d9be1b8aa8ed47cafc7f2285"}]}],"versions":["0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.61Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-319","published":"2023-04-16T14:01:58.406534Z","modified":"2026-11-11T14:45:03.997155309Z","summary":"Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\nZSTD_decompressSequencesLong_bmi2\nZSTD_decompressSequencesLong\nZSTD_decompressBlock_internal\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-319.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-319","published":"2023-04-16T14:01:58.406534Z","modified":"2026-11-12T14:30:05.065477165Z","summary":"Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\nZSTD_decompressSequencesLong_bmi2\nZSTD_decompressSequencesLong\nZSTD_decompressBlock_internal\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-319.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-606","published":"2023-07-23T14:01:02.159160Z","modified":"2026-11-11T14:45:02.976646279Z","summary":"Heap-buffer-overflow in ZSTD_decompressMultiFrame","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nZSTD_decompressMultiFrame\nZSTD_decompress_usingDDict\nzstd_wrap_decompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-606.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2023-606","published":"2023-07-23T14:01:02.159160Z","modified":"2026-11-12T14:30:04.155743409Z","summary":"Heap-buffer-overflow in ZSTD_decompressMultiFrame","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nZSTD_decompressMultiFrame\nZSTD_decompress_usingDDict\nzstd_wrap_decompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-606.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.1","id":"OSV-2024-112","published":"2024-02-16T00:05:47.896843Z","modified":"2026-10-19T14:53:10.350400Z","summary":"Stack-overflow in boost::read_graphviz_detail::parser::parse_subgraph","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719\n\n```\nCrash type: Stack-overflow\nCrash state:\nboost::read_graphviz_detail::parser::parse_subgraph\nboost::read_graphviz_detail::parser::parse_endpoint_rest\nboost::read_graphviz_detail::parser::parse_stmt\n```\n","affected":[{"package":{"name":"boost","ecosystem":"OSS-Fuzz","purl":"pkg:generic/boost"},"ranges":[{"type":"GIT","repo":"https://github.com/boostorg/boost.git","events":[{"introduced":"9072bfc2d969ca1e8c49651232817201e05e3eae"},{"introduced":"206cf016ae9454ed65e9c5faf4a322f31444fb80"}]}],"versions":["boost-1.85.0","boost-1.85.0.beta1","boost-1.86.0.beta1","boost-1.86.0","boost-1.87.0.beta1","boost-1.87.0","boost-1.88.0.beta1","boost-1.88.0","boost-1.89.0.beta1","boost-1.89.0","boost-1.90.0.beta1","boost-1.90.0","boost-1.91.0.beta1","boost-1.91.0","boost-1.91.0-1","boost-1.92.0.beta1","boost-1.92.0"],"ecosystem_specific":{"severity":"LOW"},"database_specific":{"introduced_range":"0251e5fa19564439f3d654df8d4de1abdbaa72b2:9f83dd55ea67f1bab62c20d29bc5527345aafc55","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/boost/OSV-2024-112.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-112","published":"2024-02-16T00:05:47.896843Z","modified":"2026-11-12T14:30:13.336186509Z","summary":"Stack-overflow in boost::read_graphviz_detail::parser::parse_subgraph","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719\n\n```\nCrash type: Stack-overflow\nCrash state:\nboost::read_graphviz_detail::parser::parse_subgraph\nboost::read_graphviz_detail::parser::parse_endpoint_rest\nboost::read_graphviz_detail::parser::parse_stmt\n```\n","affected":[{"package":{"name":"boost","ecosystem":"OSS-Fuzz","purl":"pkg:generic/boost"},"ranges":[{"type":"GIT","repo":"https://github.com/boostorg/boost.git","events":[{"introduced":"9072bfc2d969ca1e8c49651232817201e05e3eae"},{"introduced":"206cf016ae9454ed65e9c5faf4a322f31444fb80"}]}],"versions":["boost-1.85.0","boost-1.85.0.beta1","boost-1.86.0.beta1","boost-1.86.0","boost-1.87.0.beta1","boost-1.87.0","boost-1.88.0.beta1","boost-1.88.0","boost-1.89.0.beta1","boost-1.89.0","boost-1.90.0.beta1","boost-1.90.0","boost-1.91.0.beta1","boost-1.91.0","boost-1.91.0-1","boost-1.92.0.beta1","boost-1.92.0","boost-1.93.0.beta1"],"ecosystem_specific":{"severity":"LOW"},"database_specific":{"introduced_range":"0251e5fa19564439f3d654df8d4de1abdbaa72b2:9f83dd55ea67f1bab62c20d29bc5527345aafc55","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/boost/OSV-2024-112.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-659","published":"2024-07-18T00:01:18.765548Z","modified":"2026-11-07T14:45:04.514943621Z","summary":"Index-out-of-bounds in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392\n\n```\nCrash type: Index-out-of-bounds\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-659.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-659","published":"2024-07-18T00:01:18.765548Z","modified":"2026-11-12T14:45:02.853786785Z","summary":"Index-out-of-bounds in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392\n\n```\nCrash type: Index-out-of-bounds\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-659.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-664","published":"2024-07-18T00:13:55.576218Z","modified":"2026-11-07T14:45:04.511454120Z","summary":"Heap-buffer-overflow in gf_dash_group_get_template","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\ngf_dash_group_get_template\ngf_dash_resolve_url\ngf_dash_download_init_segment\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"7323c74ff523fa2d5c4db793d5dfbc611ae505c4"},{"introduced":"60a10d09edb60bd6b4b588d36e685cc3ad9feeb9"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-664.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-664","published":"2024-07-18T00:13:55.576218Z","modified":"2026-11-12T14:45:02.853870355Z","summary":"Heap-buffer-overflow in gf_dash_group_get_template","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\ngf_dash_group_get_template\ngf_dash_resolve_url\ngf_dash_download_init_segment\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"7323c74ff523fa2d5c4db793d5dfbc611ae505c4"},{"introduced":"60a10d09edb60bd6b4b588d36e685cc3ad9feeb9"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-664.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-695","published":"2024-07-31T00:02:35.217594Z","modified":"2026-11-07T14:45:04.512517415Z","summary":"Stack-buffer-overflow in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549\n\n```\nCrash type: Stack-buffer-overflow WRITE 4\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-695.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-695","published":"2024-07-31T00:02:35.217594Z","modified":"2026-11-12T14:45:02.856061124Z","summary":"Stack-buffer-overflow in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549\n\n```\nCrash type: Stack-buffer-overflow WRITE 4\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-695.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-719","published":"2024-08-07T00:05:22.699506Z","modified":"2026-11-07T14:45:04.513873627Z","summary":"Heap-buffer-overflow in hevc_ref_pic_lists_modification","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890\n\n```\nCrash type: Heap-buffer-overflow WRITE 4\nCrash state:\nhevc_ref_pic_lists_modification\ngf_hevc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"21cf0d2d4a0d6e5d14ffaa8472c9157f1333d379"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"cf9017e7f44c1d0c9a4e520083aece0d3ab329f7:df8121066cf8fb25cc70adf7ca8b35bda82fe216","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-719.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2024-719","published":"2024-08-07T00:05:22.699506Z","modified":"2026-11-12T14:45:02.855845907Z","summary":"Heap-buffer-overflow in hevc_ref_pic_lists_modification","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890\n\n```\nCrash type: Heap-buffer-overflow WRITE 4\nCrash state:\nhevc_ref_pic_lists_modification\ngf_hevc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"21cf0d2d4a0d6e5d14ffaa8472c9157f1333d379"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"cf9017e7f44c1d0c9a4e520083aece0d3ab329f7:df8121066cf8fb25cc70adf7ca8b35bda82fe216","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-719.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"OSV-2026-1512","published":"2026-11-08T00:22:15.690048Z","modified":"2026-11-12T12:30:04.834347956Z","summary":"Heap-buffer-overflow in cram_encode_container","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ncram_encode_container\ncram_flush_container_mt\ncram_put_bam_seq\n```\n","affected":[{"package":{"name":"htslib","ecosystem":"OSS-Fuzz","purl":"pkg:generic/htslib"},"ranges":[{"type":"GIT","repo":"https://github.com/samtools/htslib.git","events":[{"introduced":"843ca7f53fad9538fe46df2c9d5a503b6b7afbaa"},{"fixed":"711871ab53f8133115dceed997d11f481c024e0a"},{"introduced":"6ff2e25c36e82fd9194702270bca322d321e1397"}]}],"versions":["1.21.1","1.21.2","1.21.3","1.22.1","1.22.2","1.22.3","1.22.4","1.23","1.23.1","1.23.2","1.23.3","1.24","1.24.1","1.25"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"09c89d8f12b8367a5b869b563f5ae6f0888fb0f3:6a399ca07a0d6bb435676c68689ba361d592ebc9","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2026-1512.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998"}]}
|
||||
{"schema_version":"1.9.2","id":"OSV-2026-1512","published":"2026-11-08T00:22:15.690048Z","modified":"2026-11-12T14:30:05.720760431Z","summary":"Heap-buffer-overflow in cram_encode_container","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ncram_encode_container\ncram_flush_container_mt\ncram_put_bam_seq\n```\n","affected":[{"package":{"name":"htslib","ecosystem":"OSS-Fuzz","purl":"pkg:generic/htslib"},"ranges":[{"type":"GIT","repo":"https://github.com/samtools/htslib.git","events":[{"introduced":"843ca7f53fad9538fe46df2c9d5a503b6b7afbaa"},{"fixed":"711871ab53f8133115dceed997d11f481c024e0a"},{"fixed":"ae5f79dd51cd296195293690b6f59f0b982ae877"},{"introduced":"6ff2e25c36e82fd9194702270bca322d321e1397"}]}],"versions":["1.21.1","1.21.2","1.21.3","1.22.1","1.22.2","1.22.3","1.22.4","1.23","1.23.1","1.23.2","1.23.3","1.24","1.24.1","1.25"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"fixed_range":"1a66eebeaeb5230d6514476306dd2dc4141b82f3:ae5f79dd51cd296195293690b6f59f0b982ae877","introduced_range":"09c89d8f12b8367a5b869b563f5ae6f0888fb0f3:6a399ca07a0d6bb435676c68689ba361d592ebc9","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2026-1512.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-g6f8-c3x9-jv7f","published":"2026-11-12T18:21:00Z","modified":"2026-11-12T18:30:04.910495062Z","aliases":["CVE-2026-84987"],"summary":"code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check","details":"### Impact\nAn authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.\n\n### Patches\nThe problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.\n\n### Workarounds\nUse `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.","affected":[{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.23.0"}]}],"versions":["7.0.0-alpha.1","7.27.0","7.7.2","v4.0-BETA1","v4.0-BETA2","v4.0-BETA3","v4.0-BETA4","v4.0-BETA5","v4.0-BETA6","v4.0.0","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.16","v4.0.17","v4.0.18","v4.0.19","v4.0.2","v4.0.20","v4.0.21","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v5.0.0","v5.0.0-alpha.1","v5.0.0-alpha.10","v5.0.0-alpha.2","v5.0.0-alpha.3","v5.0.0-alpha.4","v5.0.0-alpha.5","v5.0.0-alpha.6","v5.0.0-alpha.7","v5.0.0-alpha.8","v5.0.0-alpha.9","v5.0.1","v5.1.0","v5.1.1","v5.1.2","v5.2.0","v5.3.0","v5.3.1","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.4.6","v6.0.0","v6.0.0-alpha.1","v6.0.0-alpha.2","v6.0.0-alpha.3","v6.0.0-alpha.4","v6.0.0-alpha.5","v6.0.0-alpha.6","v6.0.0-alpha.7","v6.0.0-beta.1","v6.0.0-beta.2","v6.0.0-beta.3","v6.0.1","v6.1.0","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.2.0","v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.5.3","v6.5.4","v6.5.5","v7.0.0","v7.0.0-beta.1","v7.0.0-beta.2","v7.0.0-beta.3","v7.0.0-beta.4","v7.0.0-beta.5","v7.0.0-beta.6","v7.0.1","v7.0.2","v7.1.0","v7.10.0","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.15.0","v7.16.0","v7.17.0","v7.17.1","v7.17.2","v7.17.3","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.20.0","v7.21.0","v7.22.0","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.24.1","v7.25.0","v7.25.1","v7.25.2","v7.26.0","v7.26.1","v7.26.2","v7.27.1","v7.28.0","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.29.4","v7.29.5","v7.29.6","v7.29.7","v7.3.0","v7.30.0","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.7.0","v7.7.1","v7.8.0","v7.9.0","v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.1.0","v8.1.1","v8.1.2","v8.2.0","v8.2.1","v8.3.0","v8.3.1","v8.3.2","v8.3.3","v8.3.4","v8.3.5","v8.3.6","v8.3.7","v8.4.0","v8.4.1","v8.4.2","v8.4.3","v8.4.4","v8.5.0","v8.6.0","v8.6.1","v9.0.0","v9.0.0-alpha.1","v9.0.0-alpha.2","v9.0.0-beta.1","v9.0.0-beta.10","v9.0.0-beta.11","v9.0.0-beta.12","v9.0.0-beta.13","v9.0.0-beta.14","v9.0.0-beta.15","v9.0.0-beta.16","v9.0.0-beta.17","v9.0.0-beta.2","v9.0.0-beta.3","v9.0.0-beta.4","v9.0.0-beta.5","v9.0.0-beta.6","v9.0.0-beta.7","v9.0.0-beta.8","v9.0.0-beta.9","v9.0.1","v9.0.2","v9.0.3","v9.0.4","v9.0.5","v9.0.6","v9.0.7","v9.0.8","v9.0.9","v9.1.0","v9.1.1","v9.1.2","v9.10.0","v9.10.1","v9.10.2","v9.11.0","v9.11.1","v9.12.0","v9.13.0","v9.13.1","v9.14.0","v9.14.1","v9.14.2","v9.14.3","v9.14.4","v9.15.0","v9.15.1","v9.16.0","v9.16.1","v9.17.0","v9.17.1","v9.18.0","v9.19.0","v9.19.1","v9.19.2","v9.19.3","v9.2.0","v9.2.1","v9.2.2","v9.2.3","v9.2.4","v9.2.5","v9.2.6","v9.2.7","v9.2.8","v9.20.0","v9.21.0","v9.21.1","v9.21.2","v9.22.0","v9.22.1","v9.22.2","v9.22.3","v9.22.4","v9.22.5","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.3.4","v9.3.5","v9.3.6","v9.3.7","v9.4.0","v9.4.1","v9.5.0","v9.5.1","v9.5.2","v9.6.0","v9.6.1","v9.6.2","v9.6.3","v9.6.4","v9.6.5","v9.6.6","v9.7.0","v9.7.1","v9.7.2","v9.7.3","v9.8.0","v9.8.1","v9.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json"}},{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-beta.1"},{"fixed":"10.0.0-beta.4"}]}],"versions":["v10.0.0-beta.1","v10.0.0-beta.2","v10.0.0-beta.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json"}}],"references":[{"type":"WEB","url":"https://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-h24v-f482-8cwf","published":"2026-11-12T18:18:44Z","modified":"2026-11-12T18:30:04.026467930Z","aliases":["CVE-2026-84974"],"summary":"code16/sharp: Arbitrary class instantiation through the embed_key API parameter","details":"### Impact\n\nAn authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.\n\n### Patches\n\nThe problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation.\n\n### Workarounds\n\nNo known workarounds.","affected":[{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.23.0"}]}],"versions":["7.0.0-alpha.1","7.27.0","7.7.2","v4.0-BETA1","v4.0-BETA2","v4.0-BETA3","v4.0-BETA4","v4.0-BETA5","v4.0-BETA6","v4.0.0","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.16","v4.0.17","v4.0.18","v4.0.19","v4.0.2","v4.0.20","v4.0.21","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v5.0.0","v5.0.0-alpha.1","v5.0.0-alpha.10","v5.0.0-alpha.2","v5.0.0-alpha.3","v5.0.0-alpha.4","v5.0.0-alpha.5","v5.0.0-alpha.6","v5.0.0-alpha.7","v5.0.0-alpha.8","v5.0.0-alpha.9","v5.0.1","v5.1.0","v5.1.1","v5.1.2","v5.2.0","v5.3.0","v5.3.1","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.4.6","v6.0.0","v6.0.0-alpha.1","v6.0.0-alpha.2","v6.0.0-alpha.3","v6.0.0-alpha.4","v6.0.0-alpha.5","v6.0.0-alpha.6","v6.0.0-alpha.7","v6.0.0-beta.1","v6.0.0-beta.2","v6.0.0-beta.3","v6.0.1","v6.1.0","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.2.0","v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.5.3","v6.5.4","v6.5.5","v7.0.0","v7.0.0-beta.1","v7.0.0-beta.2","v7.0.0-beta.3","v7.0.0-beta.4","v7.0.0-beta.5","v7.0.0-beta.6","v7.0.1","v7.0.2","v7.1.0","v7.10.0","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.15.0","v7.16.0","v7.17.0","v7.17.1","v7.17.2","v7.17.3","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.20.0","v7.21.0","v7.22.0","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.24.1","v7.25.0","v7.25.1","v7.25.2","v7.26.0","v7.26.1","v7.26.2","v7.27.1","v7.28.0","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.29.4","v7.29.5","v7.29.6","v7.29.7","v7.3.0","v7.30.0","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.7.0","v7.7.1","v7.8.0","v7.9.0","v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.1.0","v8.1.1","v8.1.2","v8.2.0","v8.2.1","v8.3.0","v8.3.1","v8.3.2","v8.3.3","v8.3.4","v8.3.5","v8.3.6","v8.3.7","v8.4.0","v8.4.1","v8.4.2","v8.4.3","v8.4.4","v8.5.0","v8.6.0","v8.6.1","v9.0.0","v9.0.0-alpha.1","v9.0.0-alpha.2","v9.0.0-beta.1","v9.0.0-beta.10","v9.0.0-beta.11","v9.0.0-beta.12","v9.0.0-beta.13","v9.0.0-beta.14","v9.0.0-beta.15","v9.0.0-beta.16","v9.0.0-beta.17","v9.0.0-beta.2","v9.0.0-beta.3","v9.0.0-beta.4","v9.0.0-beta.5","v9.0.0-beta.6","v9.0.0-beta.7","v9.0.0-beta.8","v9.0.0-beta.9","v9.0.1","v9.0.2","v9.0.3","v9.0.4","v9.0.5","v9.0.6","v9.0.7","v9.0.8","v9.0.9","v9.1.0","v9.1.1","v9.1.2","v9.10.0","v9.10.1","v9.10.2","v9.11.0","v9.11.1","v9.12.0","v9.13.0","v9.13.1","v9.14.0","v9.14.1","v9.14.2","v9.14.3","v9.14.4","v9.15.0","v9.15.1","v9.16.0","v9.16.1","v9.17.0","v9.17.1","v9.18.0","v9.19.0","v9.19.1","v9.19.2","v9.19.3","v9.2.0","v9.2.1","v9.2.2","v9.2.3","v9.2.4","v9.2.5","v9.2.6","v9.2.7","v9.2.8","v9.20.0","v9.21.0","v9.21.1","v9.21.2","v9.22.0","v9.22.1","v9.22.2","v9.22.3","v9.22.4","v9.22.5","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.3.4","v9.3.5","v9.3.6","v9.3.7","v9.4.0","v9.4.1","v9.5.0","v9.5.1","v9.5.2","v9.6.0","v9.6.1","v9.6.2","v9.6.3","v9.6.4","v9.6.5","v9.6.6","v9.7.0","v9.7.1","v9.7.2","v9.7.3","v9.8.0","v9.8.1","v9.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json"}},{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-beta.1"},{"fixed":"10.0.0-beta.4"}]}],"versions":["v10.0.0-beta.1","v10.0.0-beta.2","v10.0.0-beta.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/maLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-wqgw-9xfh-qf2g","published":"2026-11-12T23:35:39Z","modified":"2026-11-12T23:45:03.298534910Z","aliases":["CVE-2026-128066"],"summary":"Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data","details":"```\n============================================================================\nANT-2026-D7STJUWL [medium] CWE-770 dos\nMemory DoS in TIFF and EXIF IFD parsing via overlapping tag data\nLocation: src/PIL/TiffImagePlugin.py:927 in ImageFileDirectory_v2.load()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA small, crafted image file can make Pillow use thousands of times its own size in memory while the file is only being opened, which lets anyone who can submit an image crash or stall the process handling it. A 144 KB TIFF makes `Image.open()` return normally while holding 1.6 GiB of memory. The largest such standard TIFF, about 786 KB, asks for roughly 48 GiB, which in practice gets the worker killed by the operating system. The file declares a 1×1 image, so the decompression-bomb check never triggers and no warning is raised. There is no memory corruption; the impact is denial of service.\n\nThe bug is in `ImageFileDirectory_v2.load()` in `src/PIL/TiffImagePlugin.py` (around line 927). For every directory entry whose value is stored elsewhere in the file, it reads that value into a new `bytes` object with `ImageFile._safe_read(fp, count * unit_size)` and keeps it in `_tagdata`. `_safe_read()` only checks that the bytes exist. Nothing limits the total read across entries, and nothing stops every entry from pointing at the same bytes. An attacker can therefore give each of N distinct private tags an offset and count that covers the whole file, at a cost of 12 bytes per entry. Memory grows as N × file size, which is quadratic in the file size, and BigTIFF removes the 65,535-entry ceiling.\n\nThe same loop parses EXIF data, so the problem reaches beyond TIFF:\n\n* A 66 KB JPEG APP1 segment costs about 340 MiB inside `Image.open()` itself, via `_read_dpi_from_exif()`.\n* A 96 KB PNG `eXIf` chunk costs 754 MiB on `getexif()` or `ImageOps.exif_transpose()`.\n* WebP EXIF and MPO reach the same code.\n\nThe attached reproducer builds a 72 KB TIFF and a 72 KB PNG. Using only `Image.open()` and `getexif()`, each causes 412 MiB of tag data to be retained, about 6,000 times the file size. The loop dates to the original PIL 1.1.7 import, so every Pillow release since 1.0 is affected.\n\n## Details\n\n`TiffImagePlugin.ImageFileDirectory_v2.load()` reads the out-of-line value of every IFD entry into its own `bytes` object and keeps it in `self._tagdata`. Nothing bounds the sum of those reads, and nothing prevents every entry from pointing at the same region of the file. An IFD with N entries whose `(offset, count)` each cover the whole file therefore costs N × filesize bytes of memory, while the IFD itself costs only 12 bytes per entry. This one loop is the IFD parser for TIFF frames and for `Image.Exif` alike, so it is reachable from `Image.open()` on a TIFF or JPEG and from `getexif()` / `ImageOps.exif_transpose()` on PNG, JPEG, WebP and MPO.\n\nObserved on the stock build at this commit: a valid 144,110-byte 1×1 greyscale TIFF with 12,000 such entries makes `Image.open()` return normally (no exception, no warning, 1 declared pixel so `MAX_IMAGE_PIXELS` is irrelevant) after 1.5 s, with the process RSS grown from 15 MiB to 1,671 MiB and `im.tag_v2` holding 1,649 MiB of tag data for as long as the image object lives. The same IFD placed in the `eXIf` chunk of a 96 KB PNG makes `im.getexif()` retain 754 MiB. A 65,870-byte JPEG whose APP1 `Exif` segment is such an IFD (5,400 entries × 65,519 bytes) allocates ~340 MiB inside `Image.open()` itself, with no further call.\n\n```python\n# src/PIL/TiffImagePlugin.py:902-946 (ImageFileDirectory_v2.load)\nfor i in range(tag_count):\n tag, typ, count, data = ( … self._unpack(\"HHL4s\", self._ensure_read(fp, 12)))\n …\n size = count * unit_size # 918: attacker-chosen\n if size > (8 if self._bigtiff else 4):\n here = fp.tell()\n (offset,) = self._unpack(\"Q\" if self._bigtiff else \"L\", data)\n …\n fp.seek(offset) # 926: attacker-chosen\n data = ImageFile._safe_read(fp, size) # 927: new bytes object of `size`\n fp.seek(here)\n …\n self._tagdata[tag] = data # 945: kept\n self.tagtype[tag] = typ\n```\n\n`ImageFile._safe_read()` only guarantees that `size` bytes are actually present in the stream (it reads in `SAFEBLOCK` chunks and raises on truncation); it is a guard against allocating for data that does not exist, not against reading the same existing data many times. For a well-formed file each entry points at its own disjoint value, so the total read is at most the file sizeLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-xcvg-w56q-r89m","published":"2026-11-12T23:34:43Z","modified":"2026-11-12T23:45:03.322245161Z","aliases":["CVE-2026-128067"],"summary":"Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size","details":"```\n============================================================================\nANT-2026-CS7N494P [high] CWE-787 memory-safety\nHeap buffer overflow saving TIFF with libtiff when tags override image size\nLocation: src/libImaging/TiffDecode.c:1035 in ImagingLibTiffEncode()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nWhen Pillow saves an image as a compressed TIFF, size information taken from the image's metadata can make the encoder read past the end of a heap buffer. Someone who uploads an image can use this to get the server process's memory, including pointers, copied into the saved file, or to crash the process. When the metadata also enables TIFF \"Predictor=2\" compression, the encoder writes past the buffer instead, corrupting the heap and aborting the process. This affects applications that write TIFF through libtiff (any `compression=` other than raw) and either carry the source metadata across with `exif=im.getexif()` / `tiffinfo=`, or simply re-save a crafted palette TIFF with `Image.open(f).save(out, \"TIFF\")`, which inherits its compression and predictor from the upload.\n\nIn `TiffImagePlugin._save`'s libtiff branch, only `BitsPerSample` is pinned to the real image when the tag list for the encoder is built (`src/PIL/TiffImagePlugin.py:1955`). `ImageWidth`, `ImageLength` and `PlanarConfiguration` are set from `im.size` but are then overwritten by the `exif=`/`tiffinfo=` merge loop at `:1768-1772`. `SamplesPerPixel` is never set for single-band modes, so a value from the caller's tags or from the source TIFF's own IFD reaches `TIFFSetField`. `ImagingLibTiffEncode` then passes a row buffer sized from the actual image (`src/encode.c:291`) to `TIFFWriteScanline` (`src/libImaging/TiffDecode.c:1035`) with no check against `TIFFScanlineSize()`, and libtiff consumes a full scanline of the tag-described width from it.\n\nThe attached reproducer demonstrates the read case. A 64x4 greyscale JPEG whose EXIF says `SamplesPerPixel=3, Photometric=RGB` is converted into a valid RGB TIFF in which 128 bytes of each row are live heap, including pointers that change from run to run. The same JPEG with EXIF `ImageWidth=2**27` kills the process with SIGSEGV. For the write case, the values written are byte-wise differences of existing heap contents rather than attacker-chosen data, and nothing beyond the observed glibc abort is shown. The `tiffinfo=` route dates back to Pillow 2.3.0 (`dbf47837ce99`), and the `exif=` route to 8.4.0 (`c0f619384cbc`).\n\n## Details\n\nWhen an image is saved as TIFF through the libtiff encoder (any `compression=` other than raw, or `TiffImagePlugin.WRITE_LIBTIFF`), libtiff sizes its scanline from the `ImageWidth` / `SamplesPerPixel` / `BitsPerSample` / `PlanarConfiguration` tags it was handed, Pillow sizes the encoder row buffer from the real image, and nothing compares the two. In `TiffImagePlugin._save`'s libtiff branch only `BitsPerSample` is pinned in the attribute dict given to the encoder (`atts`, `src/PIL/TiffImagePlugin.py:1955-1982`); the other geometry tags can come from caller- or attacker-supplied data:\n\n- `ImageWidth` (256), `ImageLength` (257) and `PlanarConfiguration` (284) are set from `im.size` *before* the `tiffinfo=` / `exif=` merge loop at `:1768-1772`, so they are overwritten by it — by the EXIF of an uploaded JPEG, or by stale geometry in `im.getexif()` / `im.tag_v2` of a TIFF that Pillow auto-transposed on load (Orientation tag) or that the application `thumbnail()`ed.\n- `SamplesPerPixel` (277) is only put in the IFD for multi-band modes (`:1847-1850`), so for single-band images (`L`, `P`, `I;16`, `1`, …) a value from `exif=` / `tiffinfo=`, or from the *source TIFF's own IFD* via `supplied_tags` (`im.tag_v2`, `:1782`), is forwarded to libtiff. A palette TIFF with `SamplesPerPixel=2, BitsPerSample=(8,8), ExtraSamples=(0,)` opens as mode `P` (rawmode `PX`, extra sample dropped), and a bare `im.save(out, \"TIFF\")` — no save arguments; `compression` and `Predictor` are inherited from the source — already makes libtiff process `2*width` bytes per row from a `width`-byte buffer.\n\n`ImagingLibTiffEncode` then hands the image-sized row buffer to `TIFFWriteScanline`, and libtiff reads one scanline of the *tag-described* geometry out of a buffer holding one row of the *actual* image. With `Predictor = 2` (also forwarded from `tiffinfo=` / `im.tag_v2`) libtiff's horizontal differencing first rewrites the whole scanline **in place**, so the over-read becomes an out-of-bounds heap **write** on every row.\n\nThe tags do not have to be supplied deliberately by the application: `im.getexif()` of an uplLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19179","published":"2026-11-12T20:35:05Z","modified":"2026-11-12T21:15:13.349016789Z","summary":"Malicious code in eulaliatts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"eulaliatts","ecosystem":"PyPI","purl":"pkg:pypi/eulaliatts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/eulaliatts/MAL-2026-19179.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/eulaliatts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/eulaliatts","import_time":"2026-11-12T21:10:27.197530054Z","modified_time":"2026-11-12T20:40:35.956939Z","sha256":"26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19180","published":"2026-11-12T20:50:21Z","modified":"2026-11-12T21:15:14.315553603Z","summary":"Malicious code in evalometer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"evalometer","ecosystem":"PyPI","purl":"pkg:pypi/evalometer"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/evalometer/MAL-2026-19180.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/evalometer"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/evalometer","import_time":"2026-11-12T21:10:27.202886736Z","modified_time":"2026-11-12T20:50:21.708013Z","sha256":"5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19181","published":"2026-11-12T20:51:37Z","modified":"2026-11-12T21:15:13.348522423Z","summary":"Malicious code in ferrotts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"ferrotts","ecosystem":"PyPI","purl":"pkg:pypi/ferrotts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ferrotts/MAL-2026-19181.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/ferrotts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/ferrotts","import_time":"2026-11-12T21:10:27.204088178Z","modified_time":"2026-11-12T20:51:37.574633Z","sha256":"b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19182","published":"2026-11-12T20:51:14Z","modified":"2026-11-12T21:15:14.317581925Z","summary":"Malicious code in flowmetry (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"flowmetry","ecosystem":"PyPI","purl":"pkg:pypi/flowmetry"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/flowmetry/MAL-2026-19182.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/flowmetry"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/flowmetry","import_time":"2026-11-12T21:10:27.204759687Z","modified_time":"2026-11-12T20:51:14.932957Z","sha256":"3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19183","published":"2026-11-12T20:50:50Z","modified":"2026-11-12T21:15:14.318897284Z","summary":"Malicious code in garviscope (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"garviscope","ecosystem":"PyPI","purl":"pkg:pypi/garviscope"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/garviscope/MAL-2026-19183.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/garviscope"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/garviscope","import_time":"2026-11-12T21:10:27.205429893Z","modified_time":"2026-11-12T20:50:50.41215Z","sha256":"b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19184","published":"2026-11-12T20:46:39Z","modified":"2026-11-12T21:15:14.311703960Z","summary":"Malicious code in garvisuite (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"garvisuite","ecosystem":"PyPI","purl":"pkg:pypi/garvisuite"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/garvisuite/MAL-2026-19184.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/garvisuite"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/garvisuite","import_time":"2026-11-12T21:10:27.206375646Z","modified_time":"2026-11-12T20:46:39.658375Z","sha256":"aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19185","published":"2026-11-12T20:41:48Z","modified":"2026-11-12T21:15:14.315069601Z","summary":"Malicious code in inframetric (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"inframetric","ecosystem":"PyPI","purl":"pkg:pypi/inframetric"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/inframetric/MAL-2026-19185.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/inframetric"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/inframetric","import_time":"2026-11-12T21:10:27.207060793Z","modified_time":"2026-11-12T20:41:48.44655Z","sha256":"e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19186","published":"2026-11-12T20:46:16Z","modified":"2026-11-12T21:15:14.311585888Z","summary":"Malicious code in lumitts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"lumitts","ecosystem":"PyPI","purl":"pkg:pypi/lumitts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lumitts/MAL-2026-19186.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/lumitts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/lumitts","import_time":"2026-11-12T21:10:27.207723535Z","modified_time":"2026-11-12T20:46:16.923299Z","sha256":"c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19187","published":"2026-11-12T20:42:43Z","modified":"2026-11-12T21:15:13.591171436Z","summary":"Malicious code in melstagen (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"melstagen","ecosystem":"PyPI","purl":"pkg:pypi/melstagen"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/melstagen/MAL-2026-19187.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/melstagen"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/melstagen","import_time":"2026-11-12T21:10:27.208355029Z","modified_time":"2026-11-12T20:42:43.725861Z","sha256":"ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19188","published":"2026-11-12T20:49:23Z","modified":"2026-11-12T21:15:14.311610372Z","summary":"Malicious code in phoneliasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"phoneliasr","ecosystem":"PyPI","purl":"pkg:pypi/phoneliasr"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/phoneliasr/MAL-2026-19188.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/phoneliasr"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/phoneliasr","import_time":"2026-11-12T21:10:27.209020747Z","modified_time":"2026-11-12T20:49:23.710458Z","sha256":"0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19189","published":"2026-11-12T20:45:51Z","modified":"2026-11-12T21:15:14.311669412Z","summary":"Malicious code in spectrova (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"spectrova","ecosystem":"PyPI","purl":"pkg:pypi/spectrova"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spectrova/MAL-2026-19189.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/spectrova"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/spectrova","import_time":"2026-11-12T21:10:27.209671026Z","modified_time":"2026-11-12T20:45:51.472159Z","sha256":"e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19190","published":"2026-11-12T20:43:24Z","modified":"2026-11-12T21:15:14.918542422Z","summary":"Malicious code in stackvane (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (45bfb9eab4765a149f6e3ac7c08c09236115073f1b2df8a9919a6f91ffd86600)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"stackvane","ecosystem":"PyPI","purl":"pkg:pypi/stackvane"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/stackvane/MAL-2026-19190.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/stackvane"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/stackvane","import_time":"2026-11-12T21:10:27.210305876Z","modified_time":"2026-11-12T20:43:24.114632Z","sha256":"45bfb9eab4765a149f6e3ac7c08c09236115073f1b2df8a9919a6f91ffd86600","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19191","published":"2026-11-12T20:45:25Z","modified":"2026-11-12T21:15:14.920599992Z","summary":"Malicious code in voxgramasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"voxgramasr","ecosystem":"PyPI","purl":"pkg:pypi/voxgramasr"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxgramasr/MAL-2026-19191.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/voxgramasr"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/voxgramasr","import_time":"2026-11-12T21:10:27.210898116Z","modified_time":"2026-11-12T20:45:25.204875Z","sha256":"ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19192","published":"2026-11-12T20:44:38Z","modified":"2026-11-12T21:15:14.921763654Z","summary":"Malicious code in voxrelitts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"voxrelitts","ecosystem":"PyPI","purl":"pkg:pypi/voxrelitts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxrelitts/MAL-2026-19192.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/voxrelitts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/voxrelitts","import_time":"2026-11-12T21:10:27.211528017Z","modified_time":"2026-11-12T20:44:38.709734Z","sha256":"519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19193","published":"2026-11-12T20:49:48Z","modified":"2026-11-12T21:15:14.915654211Z","summary":"Malicious code in wavforge (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"wavforge","ecosystem":"PyPI","purl":"pkg:pypi/wavforge"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wavforge/MAL-2026-19193.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/wavforge"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/wavforge","import_time":"2026-11-12T21:10:27.212099388Z","modified_time":"2026-11-12T20:49:49.010837Z","sha256":"e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19199","published":"2026-11-12T21:04:04Z","modified":"2026-11-12T21:45:03.424388881Z","summary":"Malicious code in acustoviasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"acustoviasr","ecosystem":"PyPI","purl":"pkg:pypi/acustoviasr"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/acustoviasr/MAL-2026-19199.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/acustoviasr"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/acustoviasr","import_time":"2026-11-12T21:37:07.392105357Z","modified_time":"2026-11-12T21:04:04.779097Z","sha256":"1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19202","published":"2026-11-12T22:25:26Z","modified":"2026-11-12T23:15:03.232776444Z","summary":"Malicious code in dashloom (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909)\nThis package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling `pydash.invoke(...)`. The code to reach it is intended to be delivered from the now-benign GitHub file, which is then splited and passed to the vulnerable function. The same Github user account is also involved in publishing a repository that executes embedded encrypted code when called with specific arguments. The package was originally flagged by PyPI Security.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-dashloom\n\n\nReasons (based on the campaign):\n\n\n - action-hidden-in-lib-usage\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"dashloom","ecosystem":"PyPI","purl":"pkg:pypi/dashloom"},"versions":["1.0.0","1.1.0","1.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dashloom/MAL-2026-19202.json"}}],"references":[{"type":"WEB","url":"https://github.com/secure-file-crypter/secure-file-crypter/blob/d139e9955a08528126897f8ed7949f6c6b6891b4/src/pre-post-encrypt.js#L1"},{"type":"WEB","url":"https://github.com/dgilland/pydash/blob/b6bd031de47134b8e3c3977fbe65bf13cc51a205/CHANGELOG.rst?plain=1#L291"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dashloom"}],"database_specific":{"iocs":{"urls":["https://github.com/dash-loom/dashloom-helper/blob/main/src/dashloom_helper/helper.txt"]},"malicious-packages-origins":[{"id":"pypi/2026-11-dashloom/dashloom","import_time":"2026-11-12T23:09:52.557746197Z","modified_time":"2026-11-12T22:25:26.740092Z","sha256":"ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909","source":"kam193","versions":["1.0.0","1.1.0","1.1.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"PYSEC-2025-102","published":"2025-07-22T17:15:33.543Z","modified":"2026-11-05T18:30:02.541950501Z","aliases":["CVE-2025-51481","GHSA-h7x8-jv97-fvvm","PYSEC-2026-1286"],"details":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.","affected":[{"package":{"name":"dagster-ge","ecosystem":"PyPI","purl":"pkg:pypi/dagster-ge"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.14"}]}],"versions":["0.10.0","0.10.0rc0","0.10.1","0.10.1rc0","0.10.2","0.10.2rc0","0.10.3","0.10.3rc0","0.10.4","0.10.4rc0","0.10.5","0.10.5rc0","0.10.6","0.10.6rc0","0.10.7","0.10.7rc0","0.10.8","0.10.8rc0","0.10.9","0.11.0","0.11.0rc0","0.11.1","0.11.10","0.11.10rc0","0.11.10rc1","0.11.10rc2","0.11.11","0.11.11rc1","0.11.11rc5","0.11.11rc7","0.11.12","0.11.12rc0","0.11.12rc2","0.11.12rc3","0.11.13","0.11.13rc2","0.11.13rc3","0.11.13rc5","0.11.14","0.11.14rc0","0.11.14rc1","0.11.14rc2","0.11.14rc3","0.11.14rc4","0.11.14rc5","0.11.14rc7","0.11.14rc8","0.11.15","0.11.15rc0","0.11.15rc1","0.11.16","0.11.16rc10","0.11.16rc18","0.11.1rc0","0.11.2","0.11.2rc0","0.11.3","0.11.3rc0","0.11.4","0.11.4rc0","0.11.5","0.11.5rc0","0.11.5rc1","0.11.6","0.11.6rc11","0.11.6rc13","0.11.6rc14","0.11.6rc15","0.11.6rc16","0.11.6rc17","0.11.6rc18","0.11.6rc19","0.11.6rc20","0.11.6rc21","0.11.6rc22","0.11.6rc23","0.11.6rc24","0.11.6rc25","0.11.6rc26","0.11.6rc27","0.11.6rc28","0.11.6rc29","0.11.6rc31","0.11.6rc32","0.11.6rc5","0.11.6rc7","0.11.6rc8","0.11.6rc9","0.11.7","0.11.7rc1","0.11.7rc10","0.11.7rc13","0.11.7rc14","0.11.7rc2","0.11.7rc3","0.11.7rc4","0.11.7rc6","0.11.7rc7","0.11.7rc8","0.11.7rc9","0.11.8","0.11.8rc4","0.11.8rc5","0.11.9","0.11.9rc10","0.11.9rc11","0.11.9rc12","0.11.9rc6","0.11.9rc7","0.11.9rc8","0.12.0","0.12.0rc0","0.12.1","0.12.10","0.12.10rc0","0.12.10rc1","0.12.11","0.12.11rc0","0.12.12","0.12.12rc0","0.12.13","0.12.13rc0","0.12.14","0.12.14rc0","0.12.14rc1","0.12.14rc2","0.12.15","0.12.15rc2","0.12.1rc0","0.12.2","0.12.2rc0","0.12.3","0.12.3rc1","0.12.4","0.12.4rc0","0.12.4rc1","0.12.5","0.12.5rc0","0.12.6","0.12.6rc0","0.12.7","0.12.7rc0","0.12.8","0.12.8rc0","0.12.9","0.12.9rc0","0.12.9rc1","0.12.9rc2","0.13.0","0.13.0rc0","0.13.1","0.13.10","0.13.10rc3","0.13.11","0.13.11rc0","0.13.12","0.13.12rc2","0.13.13","0.13.13rc0","0.13.14","0.13.14rc0","0.13.15","0.13.15rc0","0.13.16","0.13.16rc0","0.13.17","0.13.17rc0","0.13.18","0.13.18rc0","0.13.19","0.13.19rc2","0.13.1rc0","0.13.2","0.13.2rc0","0.13.2rc2","0.13.3","0.13.3rc0","0.13.4","0.13.4rc0","0.13.5","0.13.5rc0","0.13.6","0.13.6rc0","0.13.7","0.13.7rc0","0.13.8","0.13.8rc0","0.13.9","0.13.9rc0","0.14.0","0.14.0rc0","0.14.1","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.16rc2","0.14.16rc3","0.14.16rc4","0.14.17","0.14.17rc10","0.14.17rc3","0.14.17rc4","0.14.17rc5","0.14.17rc6","0.14.17rc7","0.14.17rc8","0.14.18","0.14.18rc2","0.14.18rc3","0.14.18rc4","0.14.18rc5","0.14.18rc6","0.14.19","0.14.1rc0","0.14.2","0.14.20","0.14.20rc0","0.14.21rc0","0.14.2rc0","0.14.3","0.14.3rc0","0.14.4","0.14.4rc0","0.14.5","0.14.5rc0","0.14.6","0.14.6rc0","0.14.7","0.14.7rc0","0.14.8","0.14.8rc1","0.14.9","0.14.9rc0","0.15.0","0.15.1","0.15.10","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.0rc2","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.2","0.16.3","0.16.4","0.16.6","0.16.7","0.16.8","0.16.9","0.17.1","0.17.10","0.17.11","0.17.12","0.17.13","0.17.14","0.17.15","0.17.16","0.17.17","0.17.17rc0","0.17.18","0.17.19","0.17.2","0.17.20","0.17.21","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.17.8","0.17.9","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.14rc1","0.19.14rc2","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.19.9rc0","0.20.0","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.13rc0","0.20.13rc1","0.20.14","0.20.15","0.20.16","0.20.17","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.1","0.21.10","0.21.11","0.21.12","0.21.13","0.21.14","0.21.14rc0","0.21.2","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.2","0.23.2rc1","0.23.2rc2","0.23.2rc3","0.23.2rc4","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9","0.23.9rc0","0.24.0","0.24.1","0.24.10","0.24.11","0.24.12","0.24.13","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.2Line truncated
|
||||
{"schema_version":"1.9.2","id":"PYSEC-2025-102","published":"2025-07-22T17:15:33.543Z","modified":"2026-11-12T20:45:02.317537019Z","aliases":["CVE-2025-51481","GHSA-h7x8-jv97-fvvm","PYSEC-2026-1286"],"details":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.","affected":[{"package":{"name":"dagster-ge","ecosystem":"PyPI","purl":"pkg:pypi/dagster-ge"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.14"}]}],"versions":["0.10.0","0.10.0rc0","0.10.1","0.10.1rc0","0.10.2","0.10.2rc0","0.10.3","0.10.3rc0","0.10.4","0.10.4rc0","0.10.5","0.10.5rc0","0.10.6","0.10.6rc0","0.10.7","0.10.7rc0","0.10.8","0.10.8rc0","0.10.9","0.11.0","0.11.0rc0","0.11.1","0.11.10","0.11.10rc0","0.11.10rc1","0.11.10rc2","0.11.11","0.11.11rc1","0.11.11rc5","0.11.11rc7","0.11.12","0.11.12rc0","0.11.12rc2","0.11.12rc3","0.11.13","0.11.13rc2","0.11.13rc3","0.11.13rc5","0.11.14","0.11.14rc0","0.11.14rc1","0.11.14rc2","0.11.14rc3","0.11.14rc4","0.11.14rc5","0.11.14rc7","0.11.14rc8","0.11.15","0.11.15rc0","0.11.15rc1","0.11.16","0.11.16rc10","0.11.16rc18","0.11.1rc0","0.11.2","0.11.2rc0","0.11.3","0.11.3rc0","0.11.4","0.11.4rc0","0.11.5","0.11.5rc0","0.11.5rc1","0.11.6","0.11.6rc11","0.11.6rc13","0.11.6rc14","0.11.6rc15","0.11.6rc16","0.11.6rc17","0.11.6rc18","0.11.6rc19","0.11.6rc20","0.11.6rc21","0.11.6rc22","0.11.6rc23","0.11.6rc24","0.11.6rc25","0.11.6rc26","0.11.6rc27","0.11.6rc28","0.11.6rc29","0.11.6rc31","0.11.6rc32","0.11.6rc5","0.11.6rc7","0.11.6rc8","0.11.6rc9","0.11.7","0.11.7rc1","0.11.7rc10","0.11.7rc13","0.11.7rc14","0.11.7rc2","0.11.7rc3","0.11.7rc4","0.11.7rc6","0.11.7rc7","0.11.7rc8","0.11.7rc9","0.11.8","0.11.8rc4","0.11.8rc5","0.11.9","0.11.9rc10","0.11.9rc11","0.11.9rc12","0.11.9rc6","0.11.9rc7","0.11.9rc8","0.12.0","0.12.0rc0","0.12.1","0.12.10","0.12.10rc0","0.12.10rc1","0.12.11","0.12.11rc0","0.12.12","0.12.12rc0","0.12.13","0.12.13rc0","0.12.14","0.12.14rc0","0.12.14rc1","0.12.14rc2","0.12.15","0.12.15rc2","0.12.1rc0","0.12.2","0.12.2rc0","0.12.3","0.12.3rc1","0.12.4","0.12.4rc0","0.12.4rc1","0.12.5","0.12.5rc0","0.12.6","0.12.6rc0","0.12.7","0.12.7rc0","0.12.8","0.12.8rc0","0.12.9","0.12.9rc0","0.12.9rc1","0.12.9rc2","0.13.0","0.13.0rc0","0.13.1","0.13.10","0.13.10rc3","0.13.11","0.13.11rc0","0.13.12","0.13.12rc2","0.13.13","0.13.13rc0","0.13.14","0.13.14rc0","0.13.15","0.13.15rc0","0.13.16","0.13.16rc0","0.13.17","0.13.17rc0","0.13.18","0.13.18rc0","0.13.19","0.13.19rc2","0.13.1rc0","0.13.2","0.13.2rc0","0.13.2rc2","0.13.3","0.13.3rc0","0.13.4","0.13.4rc0","0.13.5","0.13.5rc0","0.13.6","0.13.6rc0","0.13.7","0.13.7rc0","0.13.8","0.13.8rc0","0.13.9","0.13.9rc0","0.14.0","0.14.0rc0","0.14.1","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.16rc2","0.14.16rc3","0.14.16rc4","0.14.17","0.14.17rc10","0.14.17rc3","0.14.17rc4","0.14.17rc5","0.14.17rc6","0.14.17rc7","0.14.17rc8","0.14.18","0.14.18rc2","0.14.18rc3","0.14.18rc4","0.14.18rc5","0.14.18rc6","0.14.19","0.14.1rc0","0.14.2","0.14.20","0.14.20rc0","0.14.21rc0","0.14.2rc0","0.14.3","0.14.3rc0","0.14.4","0.14.4rc0","0.14.5","0.14.5rc0","0.14.6","0.14.6rc0","0.14.7","0.14.7rc0","0.14.8","0.14.8rc1","0.14.9","0.14.9rc0","0.15.0","0.15.1","0.15.10","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.0rc2","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.2","0.16.3","0.16.4","0.16.6","0.16.7","0.16.8","0.16.9","0.17.1","0.17.10","0.17.11","0.17.12","0.17.13","0.17.14","0.17.15","0.17.16","0.17.17","0.17.17rc0","0.17.18","0.17.19","0.17.2","0.17.20","0.17.21","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.17.8","0.17.9","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.14rc1","0.19.14rc2","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.19.9rc0","0.20.0","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.13rc0","0.20.13rc1","0.20.14","0.20.15","0.20.16","0.20.17","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.1","0.21.10","0.21.11","0.21.12","0.21.13","0.21.14","0.21.14rc0","0.21.2","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.2","0.23.2rc1","0.23.2rc2","0.23.2rc3","0.23.2rc4","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9","0.23.9rc0","0.24.0","0.24.1","0.24.10","0.24.11","0.24.12","0.24.13","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.2Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-2p2f-4rq4-gjwc","published":"2026-11-12T23:38:57Z","modified":"2026-11-12T23:45:03.307009659Z","aliases":["CVE-2026-126079"],"summary":"Action View: Possible XSS vulnerability in text helpers","details":"### Impact\nWith the HTML5 sanitizer (`Rails::HTML5::Sanitizer`, the default vendor on CRuby for applications using `load_defaults 7.1` or later), Nokogiri before 1.19.5 serializes `<` and `>` unescaped inside attribute values. The Action View text helpers `highlight` and `simple_format` sanitize their input and then process the resulting HTML as a string: `highlight` splits it on tag boundaries to insert matches, and `simple_format` splits it into paragraphs on blank lines. An unescaped `>` or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's `html_safe` output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to `highlight`, or to `simple_format` with `html_options`, are affected.\n\n### Details\nThe fixed releases require rails-html-sanitizer 1.7.2 or later, which requires Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer escapes `<` and `>` in attribute values as `<` and `>`, as the HTML4 sanitizer already does. The parsed DOM is unchanged, but code or tests that compare sanitized HTML as a string may see the new serialization.\n\n### Workarounds\nUpgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by setting `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73.patch\n- 8.0: https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [azaran](https://hackerone.com/azaran).\nThis issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5",Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-345x-3rq2-jfrm","published":"2026-11-12T21:26:53Z","modified":"2026-11-12T21:45:03.445343054Z","aliases":["CVE-2026-126208"],"summary":"Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction","details":"## Summary\n\nLoofah restricts `href` and `xlink:href` on certain SVG elements to same-document references. Two elements escaped the restriction:\n\n- `<textPath>`: `SVG_ALLOW_LOCAL_HREF` listed it in lowercase as `textpath`, but the HTML5 parser names the element `textPath` inside `<svg>`, so the check never matched on the HTML5 path.\n- `<mpath>`: absent from `SVG_ALLOW_LOCAL_HREF`, so its references were never restricted on either path.\n\n`rails-html-sanitizer` reuses this safelist in its `PermitScrubber`, so it is affected too.\n\n## Impact\n\nAn external `href` or `xlink:href` on `<textPath>` or `<mpath>` survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.\n\nApplications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with `rails-html-sanitizer` with SVG elements permitted are affected.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/cdd6ff7fb51998eb181bd2da925ddbcfcc8a3b96"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-345x-3rq2-jfrm.yml"}],"database_specific":{"cwe_ids":["CWE-178","CWE-184"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:26:53Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-3f4q-8x5m-76v8","published":"2026-11-12T21:54:18Z","modified":"2026-11-12T22:00:04.075403782Z","aliases":["CVE-2026-126188"],"summary":"Active Storage: Possible local file disclosure in video previews and analysis","details":"### Impact\nActive Storage's `VideoPreviewer`, `VideoAnalyzer` and `AudioAnalyzer` run `ffmpeg` and `ffprobe` on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client can store an HLS playlist under a `video/*` or `audio/*` type. When that blob is previewed or analyzed, the `hls` demuxer opens the `file://` segments that the playlist names, and the preview image or the stored metadata could disclose a local media file that the application process can read and whose path the attacker knows.\n\nApplications that accept uploads from untrusted users and generate video previews, or analyze video or audio attachments with FFmpeg, are affected.\n\n### Details\nThe fixed releases limit the formats FFmpeg may open to common audio and video containers, configured by the new `config.active_storage.ffmpeg_allowed_formats` setting. Files in other formats no longer preview or receive media metadata; the Active Storage CHANGELOG names some of them and shows how to add a format to the list.\n\n### Workarounds\nApplications that cannot upgrade can stop Active Storage from running FFmpeg on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from `config.active_storage.previewers`, and `ActiveStorage::Analyzer::VideoAnalyzer` and `ActiveStorage::Analyzer::AudioAnalyzer` from `config.active_storage.analyzers`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282.patch\n- 8.0: https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [w3rmut](https://hackerone.com/w3rmut).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126188"},{"type":"WEB","url":"https://github.com/rails/rails/commit/3b1f2627538dc597Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-3w93-6hmw-whh4","published":"2026-11-12T23:37:55Z","modified":"2026-11-12T23:45:03.302501225Z","aliases":["CVE-2026-126084"],"summary":"Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control","details":"### Impact\nWhen a GCS service is configured with the `cache_control` option, `ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host` headers. A direct-upload client can therefore send a `Content-Type` of its choosing, and can omit the declared `Content-MD5`, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the `response-content-type` that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on `storage.googleapis.com`. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket.\n\nApplications that use the GCS service with `cache_control` configured and accept direct uploads are affected. GCS services without `cache_control` sign with V2 and are not affected.\n\n### Details\nThe fixed releases sign every GCS direct-upload URL with V2, which binds an empty `Content-Type` and the declared `Content-MD5`. The configured `Cache-Control` is still returned by `headers_for_direct_upload` and sent by the client, but it is no longer part of the signature, and direct-upload URLs for these services are no longer limited to V4's seven-day maximum expiry. See the Active Storage CHANGELOG.\n\n### Workarounds\nRemoving the `cache_control` option from the GCS service configuration makes Active Storage sign direct uploads with V2.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1.patch\n- 8.0: https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-3wLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-539f-xcgw-2gjg","published":"2026-11-12T22:44:15Z","modified":"2026-11-12T23:00:05.606817854Z","aliases":["CVE-2026-126349"],"summary":"Addressable display_uri can show misleading hosts containing bidi and invisible characters","details":"### Impact\n\n`Addressable::IDNA.to_unicode` decodes Punycode labels (labels beginning with `xn--`) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. `Addressable::URI#display_uri` uses `to_unicode`, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of `http://xn--abcmoc-dm0c.com/` is displayed as `abc`, U+202E, `moc.com`, and the override makes everything after `abc` render right to left.\n\nParsing, `host`, `normalized_host` and any connection made from the URI are not affected. Only the displayed form is. Applications that show `display_uri` to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.\n\n- In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits.\n- In the native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.\n\n### Affected Versions\n\nThe pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when `to_unicode` began accepting characters unassigned in Unicode 3.2. It is fixed in 2.9.1 for both implementations, where such labels are returned unchanged.\n\n### Workarounds\n\n- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation. This reduces the affected characters to those added since Unicode 3.2.\n- Check displayed hosts for bidirectional and invisible characters (e.g., `/[\\p{Cc}\\p{Cf}\\p{Default_Ignorable_Code_Point}]/`) and fall back to `normalized_host` when one is present.\n\n### Credits\n\nReported by @andrewstellman.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-539f-xcgw-2gjg.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1007","CWE-176","CWE-451"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:44:15Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-68p9-83h6-5wpj","published":"2026-11-12T22:08:21Z","modified":"2026-11-12T22:15:03.756635963Z","aliases":["CVE-2026-126069"],"summary":"Action View: Possible XSS vulnerability in tag helpers","details":"### Impact\nThe fix for [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq) skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as `:\" \"`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as `image_tag`, `video_tag` and `audio_tag`, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8.patch\n- 8.0: https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-73v3-wf97-vpgj","published":"2026-11-12T22:54:59Z","modified":"2026-11-12T23:00:05.611968338Z","aliases":["CVE-2026-126366"],"summary":"msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM","details":"### Summary\n\nThe **JRuby** implementation of msgpack (`msgpack` gem, `java` platform — pure Java decoder under `ext/java/`) sizes containers directly from the element count written in the message header, with **no cap at all**: no equivalent of the C unpacker's `SHRT_MAX` clamp (since 1.7.3) and none of the buffered-bytes cap that commit c8d42d8 added for CRuby in 1.8.6. A single 5-byte message decides how much memory a JVM process tries to allocate:\n\n* `array32` header declaring `0x7FFFFFFF` elements → `new IRubyObject[0x7FFFFFFF]` (~8 GiB of reference slots) attempted immediately → `java.lang.OutOfMemoryError: Requested array size exceeds VM limit`.\n* Counts *below* the VM's max-array-size but above available heap (e.g. 5×10⁸ with a 512 MiB heap) produce a **real allocation attempt** — `OutOfMemoryError: Java heap space` — the JVM genuinely tries to take the memory before failing.\n* `str32`/`bin32` headers declaring `0x7FFFFFFF` bytes do the same via `readBytes(size)` → `new byte[size]`.\n* Below the failure threshold there is a **silent band**: one streaming unpacker fed only an `array32` header with count 2×10⁷ (5 wire bytes, zero elements) grows used heap **+78 MiB immediately**, no exception (`each` swallows the underflow), and the footprint stays elevated after `Unpacker#reset` + full GC. Linear in declared count (~4 B/element); nothing bounds it — not delivered bytes, not a per-container cap.\n\nOnly counts ≥ 2³¹ are refused (a clean `MessagePack::UnderflowError` from `getUnsignedInt()`), and only **maps** are safe (`consumeHash` grows per element instead of pre-sizing). Verified on the released gem `msgpack 1.8.6 java`, JRuby 9.4.12 / OpenJDK 25, 2026-10-30 — i.e. **unfixed in the current release**. Proposed fix mirrors c8d42d8: cap initial allocation by bytes actually buffered and grow as data arrives; read strings in bounded chunks instead of allocating the declared length up front.\n\n\n### Details\n\n### 1. The four dispatch arms, and which pre-allocate (line numbers at tag v1.8.6 — current release; `ext/java` has no commits after it)\n\n| header | dispatch ([Decoder.java](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java)) | behaviour on the declared count | measured (released 1.8.6-java, Xmx512m) |\n|---|---|---|---|\n| `array32` `\\xdd` | [:296](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L296) → [`consumeArray(int size)` :139-145](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L139-L145) | `new IRubyObject[size]` **immediately**, before reading any element | count `0x7FFFFFFF`: OOME \"Requested array size exceeds VM limit\"; count 5×10⁸: OOME \"**Java heap space**\" (real allocation attempt); count 2×10⁷: **+78 MiB, silent** |\n| `str32` `\\xdb` | [:294](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L294) → [`consumeString` :129](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L129) → [`readBytes(int size)` :186-190](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L186-L190) | `new byte[size]` **immediately** | len `0x7FFFFFFF`: OOME \"array size exceeds VM limit\" |\n| `bin32` `\\xc6` | [:269](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L269) → same `consumeString`/`readBytes` | same | len `0x7FFFFFFF`: OOME \"array size exceeds VM limit\" |\n| `map32` `\\xdf` | [:298](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L298) → [`consumeHash(int size)` :147+](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L147) | **no pre-allocation** — inserts per element, underflows on first missing byte | count `0x7FFFFFFF`: no exception (swallowed), no large allocation |\n\nThe only guard is [`getUnsignedInt()` :88-94](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L88-L94): counts with the top bit set (≥ 2³¹) raise `MessagePack::UnderflowError: Size too large (limited to 2**31 for the Java version)`. That bounds the *value* but leaves the entire positive band `(available heap, 2³¹)` unbounded — and that band is where real allocation attempts happen.\n\n### 2. Contrast with the C implementation (same repo)\n\nThe CRuby unpacker has had a per-container cap since 1.7.3 (`INITIAL_BUFFER_CAPACITY_MAX = SHRT_MAX`) and, since [c8d42d8](https://github.com/msgpack/msgpack-ruby/commit/c8d42d8) in **1.8.6**, additionally caps inLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-8gmh-2hhj-2hv9","published":"2026-11-12T22:27:58Z","modified":"2026-11-12T22:45:04.162582601Z","aliases":["CVE-2026-126354"],"summary":"Addressable URI normalization resolves some dotted path segments to the wrong path","details":"### Summary\n\n`Addressable::URI.normalize_path` resolves some paths containing `..` segments to a different path than RFC 3986 does. When a path climbs above the root before any other `..` is resolved, the segments that later `..` segments should remove are instead kept: `/../../public/x/../../secret` normalizes to `/public/x/secret` instead of `/secret`. `URI#normalize`, `URI#join`, `URI#==` and `URI#===` all use this normalization. An application that checks a normalized Addressable path against an allowlist, but sends the original URI to something that resolves it according to RFC 3986, can be made to allow a request for a path outside the allowlist.\n\n### Details\n\n`normalize_path` in 2.9.0 (`lib/addressable/uri.rb`) removes dot segments by repeating a set of rewrites until nothing changes. On each pass it finds the first `/segment/../` pair with `RULE_2B_2C`, then replaces every textual copy of that pair in the path with `/`:\n\n```ruby\npair = normalized_path.match(RULE_2B_2C)\n...\nregexp = \"/#{Regexp.escape(parent.to_s)}/\\\\.\\\\./|\"\nregexp += \"(/#{Regexp.escape(current.to_s)}/\\\\.\\\\.$)\"\n...\nmod ||= normalized_path.gsub!(Regexp.new(regexp), SLASH)\n```\n\nWhen the first pair found is `/../../`, where the \"segment\" is itself `..`, every `/../../` in the path is replaced with `/`. That includes copies later in the path, where each `..` should have removed the segment before it. For `/../../public/x/../../secret`:\n\n- RFC 3986 §5.2.4 drops the two leading `..` segments, which can't go above the root, then removes `x` and `public`, giving `/secret`.\n- 2.9.0 replaces both copies of `/../../` with `/` in one step, giving `/public/x/secret`.\n\nPaths where an ordinary `/segment/../` pair comes first, such as `/a/../../b/c/../../d`, are resolved correctly.\n\nThis was introduced in 2.2.5. Versions 2.0.0 through 2.2.4 and earlier versions resolve these paths correctly. It is fixed in 2.9.1, which replaces the rewrite loop with a single pass that correctly follows RFC 3986 §5.2.4.\n\n### Proof of concept\n\n```ruby\nrequire \"addressable/uri\"\nrequire \"uri\"\n\nurl = \"http://example.com/../../public/x/../../secret\"\n\n# Addressable's normalized path, compared with RFC 3986 resolution by Ruby's URI library\nputs Addressable::URI.parse(url).normalize.path\nputs URI.join(\"http://example.com/\", \"../../public/x/../../secret\").path\n\n# join and == use the same normalization\nputs Addressable::URI.join(\"http://example.com/\", \"../../public/x/../../secret\").path\nputs Addressable::URI.parse(url) == Addressable::URI.parse(\"http://example.com/public/x/secret\")\n\n# An allowlist check on the normalized path passes, but the request reaches /secret\ndef allowed?(url) = Addressable::URI.parse(url).normalize.path.start_with?(\"/public/\")\nputs allowed?(url)\n```\n\nOutput with Addressable 2.9.0:\n\n```\n/public/x/secret\n/secret\n/public/x/secret\ntrue\ntrue\n```\n\nOutput with Addressable 2.9.1:\n\n```\n/secret\n/secret\n/secret\nfalse\nfalse\n```\n\n\n### Impact\n\nThis is an interpretation conflict (CWE-436) between Addressable and other RFC 3986 resolvers, which could lead to path traversal past an allowlist (CWE-22). An application is affected when it does both of these:\n\n- makes an access decision on a path normalized or joined by Addressable, such as \"only paths under `/public/` may be proxied\" or \"only these redirect targets are allowed\";\n- sends the original, unnormalized URI to a component that resolves dot segments itself, such as an HTTP client, a proxy, a web server or a browser.\n\nAn attacker may be able to bypass a check by exploiting behavioral differences between URI parsers. Impact from this is application-dependent. Applications that use Addressable's normalized form for both the check and the request are unaffected, as are applications that reject paths containing `..` segments.\n\nAs a work-around for unpatched versions, before making access decisions on a path, either reject any containing `..` segments, including percent-encoded forms such as `%2e%2e`, or use the same normalized value for both the check and the request.","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5"},{"fixed":"2.9.1"}]}],"versions":["2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-9crm-g4mf-wc5j","published":"2026-11-12T22:44:57Z","modified":"2026-11-12T23:00:05.713087803Z","aliases":["CVE-2026-126348"],"summary":"Addressable display_uri can show misleading hosts with invalid Punycode A-labels","details":"### Impact\n\n`Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:\n\n- labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`;\n- labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form.\n\n`Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same.\n\nThe native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.\n\n### Workarounds\n\n- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation.\n- Don't make security decisions on `display_uri` or `to_unicode` output. Compare hosts using `normalized_host`.\n\n### Credits\n\nReported by @tonghuaroot.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-9crm-g4mf-wc5j.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1007","CWE-20"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:44:57Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-9f42-57jx-vpp3","published":"2026-11-12T22:29:35Z","modified":"2026-11-12T22:45:04.068511750Z","aliases":["CVE-2026-126352"],"summary":"Addressable: Regular Expression Denial of Service in templates with multiple variables","details":"### Impact\n\nWithin the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking:\n\n1. Expressions with any operator other than `+` and `#` (e.g., `{/owner,repo,ref}`, `{.a,b}`, `{a,b,c}`, `{;a,b,c}`). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables.\n2. Expressions with the `+` or `#` operators and many variables (e.g., `{+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}`). A failing match is exponential in the number of variables.\n3. Several single-variable expressions next to each other (e.g., `{+a}{+b}{+c}` or `{a}{b}{c}`), which are polynomial in the input length.\n\nWhen `Template#match` or `Template#extract` is called with a maliciously crafted URI, this can result in uncontrolled resource consumption, leading to denial of service. A three-variable path template such as `http://example.com/repos{/owner,repo,ref}` needs about 2 KB of input to occupy a thread for many seconds.\n\nUsers of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.\n\nThe vulnerability is exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. The second form, many-variable `+` and `#` expressions, is also exploitable on MRI Ruby 3.2, which does not memoize a regular expression that contains possessive quantifiers, and 2.9.0 generates those for these operators. It is also exploitable on TruffleRuby 40.0, whose regular expression engine falls back to backtracking for them. MRI Ruby 3.3 and later are not affected by any form, because they memoize those regular expressions too. TruffleRuby 40.0 is not affected by the other two forms. Earlier TruffleRuby versions were not tested.\n\nThis has been confirmed on the following runtimes with Addressable 2.9.0:\n\n| Runtime | Status |\n|---------|--------|\n| MRI Ruby 2.7 | Vulnerable |\n| MRI Ruby 3.1 | Vulnerable |\n| MRI Ruby 3.2 | Vulnerable |\n| MRI Ruby 3.3 | Not affected |\n| MRI Ruby 3.4 | Not affected |\n| MRI Ruby 4.0 | Not affected |\n| JRuby 9.4 | Vulnerable |\n| JRuby 10.1 | Vulnerable |\n| TruffleRuby 40.0 | Vulnerable |\n\n### Workarounds\n\n- Upgrade to MRI Ruby 3.3 or later, if a consuming application does not use JRuby or TruffleRuby.\n- Avoid matching user-supplied input on unpatched versions of the library against templates with several variables in one expression, or with several expressions next to each other.\n- Apply a short timeout around any call to `Template#match` or `Template#extract` that processes user-supplied data.\n\n### Credits\n\nReported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.9.1"}]}],"versions":["2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/f2b27b3ab252e56b3fa3519f7ebb491d54cf7b7c"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-9f42-57jx-vpp3.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:29:35Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-f3w6-w445-fwh9","published":"2026-11-12T23:46:51Z","modified":"2026-11-13T00:00:05.204116648Z","aliases":["CVE-2026-122006","CVE-2026-126082"],"summary":"Active Storage: Possible arbitrary file write and read in image analysis","details":"### Impact\nA Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include `secret_key_base` and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.\n\n### Details\nImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to invoke one. Attaching the upload is sufficient; no variant, preview, or `analyze` call is required. One specific attack chain has been reported to us, but we do not assume it is the only one that exists.\n\nThe fixed versions ship an ImageMagick security policy and prepend its directory to `MAGICK_CONFIGURE_PATH` through `MiniMagick.cli_env`, so every ImageMagick process that MiniMagick spawns applies it. The policy denies the `MSL` scripting coder, the coders that read or delete files other than the image, fetch remote or local references, or display to a screen, every coder backed by Ghostscript together with the `gs` delegate, and `@filename` indirection. ImageMagick applies every `policy.xml` on its search path, so the shipped policy adds to the host's policy rather than replacing it. The policy applies to every ImageMagick command that MiniMagick runs, not only those of Active Storage. See the `activestorage` CHANGELOG and \"ImageMagick Security Policy\" in the Active Storage guide.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Uses ImageMagick for Active Storage image processing. This is `config.active_storage.variant_processor = :mini_magick`, which is the default for applications on `load_defaults 6.1` or earlier.\n- Runs ImageMagick under a security policy that does not already deny the coders involved. The policies that Debian and Ubuntu package do not.\n- Allows file uploads from untrusted users.\n\n### Mitigation\n- Upgrade to a fixed version of `activestorage`.\n- An application whose variant processor is `:mini_magick` must use mini_magick `>= 5.1`, which applying the policy requires. With an older mini_magick, such an application raises an exception during boot.\n- An application that renders PostScript or PDF through ImageMagick must re-allow the `gs` delegate and the coders it uses in the host's `policy.xml`.\n- An application that replaces `MiniMagick.cli_env` after boot, clears the environment with `MiniMagick.cli_prefix`, or installs its own `MiniMagick::Shell` does not receive the shipped policy and must carry its rules in ImageMagick's system policy. GraphicsMagick does not read ImageMagick policies.\n- If attachments are stored with the Disk service, change `secret_key_base` and every secret readable by the application process, including the master key and everything `config/credentials.yml.enc` holds, storage and database credentials, and third-party tokens. Do not retain an exposed secret as a fallback.\n\n### Workarounds\nCopy the rules of the policy that the fixed versions ship, `activestorage/lib/active_storage/image_magick/policy.xml`, into ImageMagick's system policy, for example `/etc/ImageMagick-7/policy.xml`. At a minimum, deny the `MSL` coder, the Ghostscript coders, and the `gs` delegate:\n\n```xml\n<policy domain=\"coder\" rights=\"none\" pattern=\"MSL\"/>\n<policy domain=\"delegate\" rights=\"none\" pattern=\"gs\"/>\n<policy domain=\"coder\" rights=\"none\" pattern=\"{PS,PS2,PS3,EPS,EPS2,EPS3,EPI,EPSF,EPSI,EPT,EPT2,EPT3,PDF,AI,EPDF,PDFA,POCKETMOD,XPS,PCL}\"/>\n```\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328\n- 8.0: https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776\n\n### Versions affected\n- activestorage < 8.0.5.2\n- activestorage >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [ryotak](https://hackerone.com/ryotak).\n\n### References\n- ImageMagick [security policy](https://imagemagick.org/security-policy/)","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-h6v6-rg66-fqj4","published":"2026-11-12T20:52:09Z","modified":"2026-11-12T21:00:03.784161248Z","aliases":["CVE-2026-126203"],"summary":"Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values","details":"## Summary\n\nLoofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape `<` and `>` in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The `:strip` scrubber is affected in every browser. The `:prune` and `:escape` scrubbers are affected in WebKit browsers such as Safari.\n\nNokogiri 1.19.5 escapes `<` and `>` in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.\n\n## Impact\n\nApplications that sanitize untrusted HTML with Loofah's HTML5 API (`Loofah.html5_fragment`, `Loofah.html5_document` and the `scrub_html5_*` methods) and display the result to other people are affected, including with the default allowlist.\n\nNot affected: Loofah's HTML4 API (including `Loofah::Helpers.sanitize`), the `:whitewash` scrubber, rails-html-sanitizer's default configuration, and JRuby.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.25.3"}]}],"versions":["2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3741"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/7ba1e7b77e043fb7dc832ef746fcbf83137135e6"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/635abc8d65c75d594ddf8957fbfbfd822c2c0dbd"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-h6v6-rg66-fqj4.yml"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-116","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:52:09Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-j82w-28jv-3pmj","published":"2026-11-12T22:30:37Z","modified":"2026-11-12T22:45:04.063599148Z","aliases":["CVE-2026-126350"],"summary":"Addressable: Regular Expression Denial of Service in templates with certain exploded expressions","details":"### Impact\n\nWithin the URI template implementation in Addressable, templates using the `*` (explode) modifier with the `/`, `.`, `;`, `?` or `&` operators (e.g., `{/segments*}`, `{.ext*}`, `{;params*}`, `{?query*}`) generate regular expressions vulnerable to catastrophic backtracking. When `Template#match` or `Template#extract` is called with a maliciously crafted URI that starts with the operator's leading character, matching takes exponential time, leading to uncontrolled resource consumption and denial of service. An input under 60 bytes is enough to occupy a thread for minutes.\n\nGHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as fully remediated in 2.9.0. The 2.9.0 fix only made the joiner between exploded members mandatory for templates without an operator, and its regression specs used inputs that never start with the operator's leading character, so the vulnerable part of the expression was never reached. This issue was originally reported in #364 by @ebenoist in 2019 but insufficiently investigated.\n\nUsers of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.\n\nThe vulnerability is only exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. MRI Ruby 3.2 and later are not affected: their regular expression engine memoizes backtracking, so these patterns still match in linear time. TruffleRuby 40.0 is not affected either. Earlier TruffleRuby versions were not tested.\n\nThis has been confirmed on the following runtimes with Addressable 2.9.0:\n\n| Runtime | Status |\n|---------|--------|\n| MRI Ruby 2.7 | Vulnerable |\n| MRI Ruby 3.1 | Vulnerable |\n| MRI Ruby 3.2 | Not affected |\n| MRI Ruby 3.3 | Not affected |\n| MRI Ruby 3.4 | Not affected |\n| MRI Ruby 4.0 | Not affected |\n| JRuby 9.4 | Vulnerable |\n| TruffleRuby 40.0 | Not affected |\n\n### Workarounds\n\n- Upgrade to MRI Ruby 3.2 or later, if the consuming application does not use JRuby.\n- Avoid matching user-supplied input on unpatched versions of the library against templates that use the `*` modifier with the `/`, `.`, `;`, `?` or `&` operators.\n- Apply a short timeout around any call to `Template#match` or `Template#extract` that processes user-supplied data.\n\n### Credits\n\nReported independently by @ebenoist, @andrewstellman, and then @halogenandtoast.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.9.1"}]}],"versions":["2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/issues/364"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-j82w-28jv-3pmj.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:30:37Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-jcff-cj73-4w4f","published":"2026-11-12T20:56:30Z","modified":"2026-11-12T21:00:03.782376099Z","aliases":["CVE-2026-126206"],"summary":"Loofah allowed_uri? treats data:text/html as safe text/plain","details":"## Summary\n\n`Loofah::HTML5::Scrub.allowed_uri?` returns `true` for a `data:` URI whose mediatype is written with the HTML5 named character reference `/` in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed `text/plain`, while a browser decodes the reference and reads the same URI as `text/html`.\n\n## Details\n\n`allowed_uri?` decodes HTML entities with `CGI.unescapeHTML`, which handles numeric character references but not HTML5 named character references. `/` therefore survives normalization, so the mediatype carries no `/`, fails the MIME grammar, and falls back to the allowed `text/plain` under the WHATWG rule for a malformed mediatype.\n\n`:`, `/`, `	` and `
` are the only named character references in the HTML5 table that decode to characters that change how a URI parses (U+003A, U+002F, U+0009 and U+000A; there is no named reference for U+000D), so this closes the set.\n\nLoofah's default `sanitize()` path is **not** affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public `allowed_uri?` string-level helper that pass it HTML-encoded strings.\n\n## Impact\n\nApplications that validate a user-controlled URL with `Loofah::HTML5::Scrub.allowed_uri?` and then render the approved value into an `href` or another browser-interpreted URI attribute may be vulnerable to cross-site scripting. `Rails::HTML::Sanitizer.allowed_uri?` re-exports the same helper.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.\n\n## Credit\n\nResponsibly reported by GitHub user @ngpestelos.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.3"}]}],"versions":["2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-jcff-cj73-4w4f.yml"}],"database_specific":{"cwe_ids":["CWE-184","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:56:30Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-m3x9-938q-5767","published":"2026-11-12T21:05:41Z","modified":"2026-11-12T21:15:10.375448259Z","aliases":["CVE-2026-126207"],"summary":"Loofah: CSS url() sanitization bypass via escaped parentheses","details":"## Summary\n\n`Loofah::HTML5::Scrub.scrub_css` rejected any property whose top-level Crass tokens included a `:url` or `:bad_url`, and left `url` out of the allowed CSS functions. Both checks ran only against the first parse of the `style` attribute. When `scrub_css` rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — `url\\28 …\\29` — hid the `url` token from the checks, and the rebuilt value was re-parsed into a live `url()` that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.\n\n## Impact\n\nA sanitized `style` attribute could make a viewer's browser issue a request to an attacker-chosen URL. `list-style` fetches on render with no interaction, `cursor` on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.\n\nApplications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.\n\n## Credit\n\nReported by NotAFlightRisk through GitHub's private vulnerability reporting.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-m3x9-938q-5767.yml"}],"database_specific":{"cwe_ids":["CWE-180","CWE-184"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:05:41Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-mf2j-8f84-cc9q","published":"2026-11-12T21:00:42Z","modified":"2026-11-12T21:15:10.377890075Z","aliases":["CVE-2026-126205"],"summary":"Loofah: Regular expression denial of service in the SVG local-reference check","details":"## Summary\n\nLoofah's HTML5 sanitizer restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\\s*[^#\\s].*/m`. In Ruby `^` anchors to every line start and `\\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.\n\nOnly Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.\n\n## Impact\n\nAn attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace.\n\nThe default safelist allows the elements in `SVG_ALLOW_LOCAL_HREF`, so no configuration change is required.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.\n\n## Credit\n\nReported by scyoon through the Rails HackerOne program.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-mf2j-8f84-cc9q.yml"}],"database_specific":{"cwe_ids":["CWE-1333","CWE-400"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:00:42Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-p9wj-w8xq-vjx6","published":"2026-11-12T21:26:25Z","modified":"2026-11-12T21:30:03.002169937Z","aliases":["CVE-2026-126209"],"summary":"Loofah allowed_uri? treats javascript: alert(1) as safe","details":"## Summary\n\n`Loofah::HTML5::Scrub.allowed_uri?` returns `true` for a `javascript:` or `vbscript:` URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that `allowed_uri?` strips, such as a space or tab. A browser ends the reference at that character and reads `javascript: alert(1)` as `javascript: alert(1)`.\n\n## Details\n\n`allowed_uri?` strips control characters and whitespace before it decodes numeric character references. Removing the character that ends a semicolon-less reference lets the reference run on into the following text, so `: alert` decodes as `Ϊ` (U+03AA) instead of a colon, and no scheme is detected. The same applies to decimal references and to references that encode a scheme letter, as in `j\\tavascript:alert(1)`.\n\nLoofah's default `sanitize()` path is **not** affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public `allowed_uri?` string-level helper that pass it HTML-encoded strings.\n\n## Impact\n\nApplications that validate a user-controlled URL with `Loofah::HTML5::Scrub.allowed_uri?` and then render the approved value into an `href` or another browser-interpreted URI attribute may be vulnerable to cross-site scripting. `Rails::HTML::Sanitizer.allowed_uri?` re-exports the same helper.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.\n\n## Credit\n\nResponsibly reported by GitHub user @manus-pi.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.0"},{"fixed":"2.25.3"}]}],"versions":["2.25.0","2.25.1","2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-p9wj-w8xq-vjx6"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-p9wj-w8xq-vjx6.yml"}],"database_specific":{"cwe_ids":["CWE-184","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:26:25Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-qq38-m9mg-xjj5","published":"2026-11-12T22:35:33Z","modified":"2026-11-12T22:45:03.586718810Z","aliases":["CVE-2026-126351"],"summary":"Addressable: Denial of service in URI path normalization","details":"### Impact\n\n`Addressable::URI.normalize_path` takes time quadratic in the number of nested dot segments in a path (e.g., `\"/\" + \"a/\" * n + \"../\" * n`, which for n = 3 is `/a/a/a/../../../`), because it removes one dot segment per pass over the whole path. `URI#normalize`, `URI#normalized_path`, `URI#==`, `URI#===` and `URI#join` all call it. Normalizing, comparing or joining a URI taken from user input can result in uncontrolled resource consumption, leading to denial of service. On 2.9.0, normalizing a 34 KB path takes about 3.5 seconds on MRI Ruby 4.0, and the cost grows with the square of the path length.\n\nThis affects every Ruby implementation, including MRI Ruby 3.2 and later. `URI.parse` by itself is unaffected, as is code that never normalizes, compares, or joins URIs from untrusted sources.\n\n### Affected Versions\n\nThis vulnerability affects all versions of Addressable prior to 2.9.1. It is fixed in 2.9.1.\n\n### Workarounds\n\n- Limit the length of URIs taken from user input before calling `normalize`, `==` or `join` on them. Web servers often limit request lines to about 8 KB, which keeps the cost to about 150 milliseconds per call on typical hardware, but URIs from other sources (request bodies, headers such as `Location`, stored data) may not be limited.\n- Reject paths with many dot segments before normalizing them.\n\n### Credits\n\nReported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security, who also suggested the single-pass approach used in the fix.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1"}]}],"versions":["0.1.0","0.1.1","0.1.2","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-qq38-m9mg-xjj5.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:35:33Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-rq8q-p985-fjq7","published":"2026-11-12T23:39:41Z","modified":"2026-11-12T23:45:03.332653910Z","aliases":["CVE-2026-126070"],"summary":"Action View: Possible XSS vulnerability in strip_tags","details":"### Impact\n`strip_tags` in Action View returns its sanitized output marked `html_safe`, but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `\"` and `'` unencoded. Because ERB does not escape a string marked `html_safe`, untrusted input passed through `strip_tags` and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render `strip_tags` output from untrusted input inside an HTML attribute, for example in a `title` attribute or a `<meta content>` tag, are affected. Output rendered as element content is not affected.\n\n### Details\n`strip_tags` now encodes `\"` and `'` in its output, as well as `&`, `<` and `>`, without double-encoding existing entities. Applications that use `strip_tags` output outside HTML, such as in a text template or JSON, now see `"` and `'` where they saw `\"` and `'`; `CGI.unescapeHTML` decodes them. See the Action View CHANGELOG.\n\n### Workarounds\nPass `strip_tags` output to an attribute through a tag helper, which escapes attribute values, for example `tag.a(title: strip_tags(user_input))`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch\n- 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [lucasluitjes](https://hackerone.com/lucasluitjes).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6",Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-rwvh-fw6r-pwvp","published":"2026-11-12T23:45:24Z","modified":"2026-11-13T00:00:05.211681497Z","aliases":["CVE-2026-126072"],"summary":"Action Pack: Possible DoS vulnerability in Action Controller Live streaming","details":"### Impact\n`ActionController::Live::Buffer#close` pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and `Buffer#abort`, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its `ActionController::Live` thread, possibly resulting in a DoS vulnerability through thread exhaustion.\n\nApplications that stream responses with `ActionController::Live`, including `send_stream`, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch\n- 8.0: https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1",Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-v6rj-xm57-3p59","published":"2026-11-12T23:41:50Z","modified":"2026-11-12T23:45:03.296036447Z","aliases":["CVE-2026-126078"],"summary":"Action View: Possible XSS vulnerability in highlight helper","details":"### Impact\n`ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase into the `:highlighter` string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the `<a href=\"search?q=\\1\">` form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a `:highlighter` that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default `<mark>\\1</mark>` highlighter and the block form are not affected.\n\n### Details\nThe fixed releases HTML-escape each group substituted into the `:highlighter` string, so quotes in a match are rendered as `"` and `'`. Only the numbered placeholders `\\0` to `\\9` are expanded; other `String#sub` replacement escapes, such as `\\k<name>`, `\\&` and `\\\\`, are left as written. A match can no longer begin on the `>` that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.\n\n### Workarounds\nUse a `:highlighter` that places the matched phrase only in element content, such as the default `<mark>\\1</mark>`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch\n- 8.0: https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-wgv4-95jc-33jm","published":"2026-11-04T15:32:31Z","modified":"2026-11-13T00:00:05.213569079Z","withdrawn":"2026-11-12T23:46:24Z","summary":"Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-f3w6-w445-fwh9. This link is maintained to preserve external references.\n\n## Original Description\nThe activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1","8.0.5.2","8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4","8.1.4.1"],"database_specific":{"last_known_affected_version_range":"< 8.0.5.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122006"},{"type":"WEB","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/pull/1300"},{"type":"WEB","url":"https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"}],"database_specific":{"cwe_ids":["CWE-1188"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:46:24Z","nvd_published_at":"2026-11-04T15:17:42Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-wm3x-v3qw-4jh3","published":"2026-11-12T23:37:09Z","modified":"2026-11-12T23:45:03.300210592Z","aliases":["CVE-2026-126081"],"summary":"Action Pack: Possible Strong Parameters Bypass in Parameters#each_key","details":"### Impact\n`ActionController::Parameters#each_key` delegates to the internal `ActiveSupport::HashWithIndifferentAccess` that holds the request parameters, so when called with a block it returns that hash instead of the `Parameters` instance. The hash does not respond to `permitted?`, so Active Model mass assignment (`new`, `assign_attributes`, `update`) accepts it without raising `ActiveModel::ForbiddenAttributesError`. An application that passes the return value of `each_key` to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.\n\nThis is an incomplete fix of [CVE-2020-8164](https://github.com/advisories/GHSA-8727-m6gj-mc37), which made `each`, `each_pair` and `each_value` return the `Parameters` instance but left `each_key` delegated.\n\n### Details\nThe fixed releases define `Parameters#each_key` to yield each key and return the `Parameters` instance when given a block, as `each`, `each_pair` and `each_value` do, and to return an `Enumerator` without one. Code that used the return value of `each_key` as a hash now receives the `Parameters` instance, which mass assignment rejects unless it is permitted.\n\n### Affected applications\nAn application is affected if it passes the return value of `ActionController::Parameters#each_key`, called with a block, to mass assignment. Rails itself makes no such call.\n\n### Workarounds\nDo not use the return value of `each_key`. Call it for its block only, and pass the permitted `Parameters` instance to mass assignment.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac.patch\n- 8.0: https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c.patch\n\n### Versions affected\n- actionpack < 8.0.5.2\n- actionpack >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [smlee](https://hackerone.com/smlee).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-x6mj-8jx9-qhqv","published":"2026-11-12T23:44:39Z","modified":"2026-11-13T00:00:05.213491996Z","aliases":["CVE-2026-126077"],"summary":"Action Pack: Possible sensitive session information leak in Active Storage proxy mode","details":"### Impact\nWhen `ActionDispatch::Cookies` reads a signed or encrypted cookie that was written under a rotated secret (`config.action_dispatch.cookies_rotations`) or in the format that a `:hybrid` cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores `request.session_options[:skip]`. `ActiveStorage::DisableSession` relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in `Set-Cookie` on a cacheable response. A shared cache that stores such a response together with its `Set-Cookie` header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users.\n\nApplications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a `:hybrid` serializer migration configured, and run behind a cache that stores `Set-Cookie` on public responses. This is a path around the fix for [CVE-2024-26144](https://github.com/advisories/GHSA-8h22-8cf7-hq6g).\n\n### Details\nIn the fixed releases, a response that skips the session leaves an old-format signed or encrypted cookie unchanged, and the next request that does not skip the session upgrades it. An application that skips the session on every request no longer upgrades its signed or encrypted cookies. Cookies that the application sets explicitly are still written. See the Action Pack CHANGELOG.\n\n### Workarounds\nConfigure caching proxies not to store responses that carry a `Set-Cookie` header, or complete the cookie rotation or serializer migration and remove it from the configuration.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556.patch\n- 8.0: https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [flashmyname](https://hackerone.com/flashmyname).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1Line truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19156","published":"2026-11-12T15:51:49Z","modified":"2026-11-12T16:30:05.032592977Z","summary":"Malicious code in buffer-code-exercise-api (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68)\nThe gem declares ext/mkrf_conf.rb as a native extension via the gemspec `extensions:` entry, which causes RubyGems to execute the script during `gem install`. The script performs no native build work and ships no native sources. Instead, it collects hostname, login name, current working directory, home directory, and the contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf, JSON-encodes them, and POSTs them over TLS to the hardcoded host 0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com (a Burp Collaborator out-of-band interaction subdomain), preceded by a DNS probe to the same host. The destination is not associated with the package's publisher, and the files read bear no relation to building a native extension. The extension entry is used purely as an install-time execution vector.\n","affected":[{"package":{"name":"buffer-code-exercise-api","ecosystem":"RubyGems","purl":"pkg:gem/buffer-code-exercise-api"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"4b4a59c95e189d6d47ae981157f6a64b0d7a2271accd155e3c17f2f881b59abe","tlsh":"6f110299938d7c609b5284afd60cb4c26497dd86c5065c62bb9904a0cf6ef7d33305f5"},{"path":"metadata.yaml","sha256":"043781dea297aca4ad762b455826ba1b4818a946e91e3d403570984ba239742e","tlsh":"65119b80bac7e47af101e2e75c103707b3b3d918bea63c019a8bd2ea03d596a3747165"}],"package_integrity":[{"filename":"buffer-code-exercise-api-1.0.1.gem","hashes":{"sha256":"78134ed0f7174961a7510e0478ae477de0f63fdf0ef17f5ba57e597c05e283bf"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/buffer-code-exercise-api/MAL-2026-19156.json"}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/buffer-code-exercise-api/versions/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022649","import_time":"2026-11-12T16:13:53.481802657Z","modified_time":"2026-11-12T15:51:49Z","sha256":"b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19157","published":"2026-11-12T15:51:40Z","modified":"2026-11-12T16:30:05.040708260Z","summary":"Malicious code in cheesebox (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76)\nThe gem declares mkrf_conf.rb as a native extension in its gemspec, causing it to execute automatically during `gem install`. On execution the script reads installer-side system files (/etc/passwd, /etc/hosts, /etc/resolv.conf) and collects host identifiers (hostname, username, home directory, current working directory), then opens a TLS TCPSocket to the hardcoded Burp Collaborator subdomain xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com on port 443 and POSTs the collected data as JSON. The destination is an attacker-controlled out-of-band interaction host, not any infrastructure related to the gem's declared purpose, and the data read is unrelated to building a native extension (no mkmf probing, no compilation of shipped sources).\n","affected":[{"package":{"name":"cheesebox","ecosystem":"RubyGems","purl":"pkg:gem/cheesebox"},"versions":["10.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"298d01af34f1ff9361870ff26078aff9a19249828e81056e2f3b877268124bc8","tlsh":"ad11328857897cf06b6288efd14c20826493ce5aca452462ff9944a0cfadb3c33319f9"}],"package_integrity":[{"filename":"cheesebox-10.0.1.gem","hashes":{"sha256":"c020e06f85c8f9ad442392d84b8b0e9608b19484c8e81e9e058e999568501e9a"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/cheesebox/MAL-2026-19157.json"}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/cheesebox/versions/10.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022648","import_time":"2026-11-12T16:13:53.337029441Z","modified_time":"2026-11-12T15:51:40Z","sha256":"5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76","source":"amazon-inspector","versions":["10.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19177","published":"2026-11-12T17:40:54Z","modified":"2026-11-12T20:15:03.341225514Z","summary":"Malicious code in pentest-copilot (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32)\nThe gem declares an extension script (mkrf_conf.rb / RakeBuilder) that runs automatically on `gem install`. At install time it collects installer-side identifiers (current working directory, home directory, hostname, login name) and reads local files /etc/resolv.conf, /etc/passwd, and /etc/hosts, then performs a DNS lookup to the Burp Collaborator subdomain vfe1kgmcry39220zb5fl06hi49acy2mr.oastify.com and opens a TLS connection to the same host on port 443, POSTing the collected host identifiers and file contents in the request body. The Collaborator destination is attacker-controlled out-of-band infrastructure typical of install-time exfiltration beacons.\n\n## Source: ossf-package-analysis (8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019)\nThe OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"pentest-copilot","ecosystem":"RubyGems","purl":"pkg:gem/pentest-copilot"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"0872c1c9caf6513f3d62e81004a9668621f4eb492fe90d5f8b934f476c2a8282","tlsh":"2d11cc8893587d61dba688afe20c308064d7dd8ac5095960fa9d48a0df6db3e33305fa"}],"package_integrity":[{"filename":"pentest-copilot-1.0.1.gem","hashes":{"sha256":"1e5097c9a1bbc59e48e52232bea642596eda7cd260d6deee1eb47794a7361144"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/pentest-copilot/MAL-2026-19177.json"}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/pentest-copilot/versions/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-12T18:14:25.465927718Z","modified_time":"2026-11-12T17:40:54Z","sha256":"8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019","source":"ossf-package-analysis","versions":["1.0.1"]},{"id":"IN-MAL-2026-022650","import_time":"2026-11-12T20:11:33.364530285Z","modified_time":"2026-11-12T19:56:48Z","sha256":"23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"GHSA-5j98-2g5x-46v6","published":"2026-10-05T22:54:35Z","modified":"2026-10-05T23:00:04.250222435Z","aliases":["CVE-2026-93657"],"summary":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","details":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5j98-2g5x-46v6/GHSA-5j98-2g5x-46v6.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-347"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:54:35Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}
|
||||
{"schema_version":"1.9.0","id":"GHSA-5j98-2g5x-46v6","published":"2026-10-05T22:54:35Z","modified":"2026-11-12T14:40:54.257337988Z","aliases":["CVE-2026-93657","RUSTSEC-2026-0514"],"summary":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","details":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5j98-2g5x-46v6/GHSA-5j98-2g5x-46v6.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-347"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:54:35Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"GHSA-6w6g-hm98-mhgm","published":"2026-10-05T22:55:10Z","modified":"2026-11-08T10:56:09.807310548Z","aliases":["CVE-2026-123604"],"summary":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","details":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6w6g-hm98-mhgm/GHSA-6w6g-hm98-mhgm.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-400","CWE-406","CWE-835"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:55:10Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}
|
||||
{"schema_version":"1.9.0","id":"GHSA-6w6g-hm98-mhgm","published":"2026-10-05T22:55:10Z","modified":"2026-11-12T14:41:01.256333284Z","aliases":["CVE-2026-123604","RUSTSEC-2026-0513"],"summary":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","details":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6w6g-hm98-mhgm/GHSA-6w6g-hm98-mhgm.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-400","CWE-406","CWE-835"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:55:10Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19200","published":"2026-11-12T21:47:36Z","modified":"2026-11-12T22:15:03.354624359Z","summary":"Malicious code in basek (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63)\nbasek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed get_data() routine polls Windows key states for alphanumeric, function, and special keys and batches captured keystrokes together with the local username. The batches are POSTed to the Telegram Bot API at api.telegram.org/bot<token>/sendMessage using a bot token stored as a byte array XORed with 0xAA and reassembled at runtime via the ut! macro, with hardcoded chat_id 7304091279; a secondary exfiltration endpoint https://keylogger.nullsect0r.tech/log is also configured. The crate installs itself for persistence: ensure_installed() copies the host binary to %LOCALAPPDATA%\\WindowsSystemUtility\\WinSysUtils.exe, writes an HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run value named 'WinSysUtils' for boot persistence, spawns a watchdog clone under a random 12-digit filename to respawn the keylogger, and schedules a cmd.exe timeout+del sequence to self-delete the original. A 30-second initial sleep, a 20-second warmup during which keystrokes are observed but not logged, and randomized polling jitter are used to evade sandbox and behavioral analysis. The crate description's 'educational cybersecurity project' framing is contradicted by the XOR-obfuscated exfiltration destination, hardcoded attacker chat_id, Run-key persistence, watchdog respawn, and self-delete logic.\n","affected":[{"package":{"name":"basek","ecosystem":"crates.io","purl":"pkg:cargo/basek"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/lib.rs","sha256":"296b7f456bf4eb4b1bfc8aff26af19b0b08d3fd12571c2fa41ea5ec0c8cf69c4","tlsh":"2e9264569a96112c6db3b87e0b9fe13337e5a12be4168d21390c4f887f9501885fc3e3"}],"package_integrity":[{"filename":"basek-0.1.0.crate","hashes":{"sha256":"a566084b69d04589f430f1b42b681df5ff86c7c681dd5370c00e4acf843709f7"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/basek/MAL-2026-19200.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/basek/0.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022652","import_time":"2026-11-12T22:10:48.52414254Z","modified_time":"2026-11-12T21:47:36Z","sha256":"f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19201","published":"2026-11-12T21:47:28Z","modified":"2026-11-12T22:15:03.375909617Z","summary":"Malicious code in hesk (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391)\nThe crate ships two reachable async payloads — `pub async fn dat` in src/test.rs and `pub async fn bs` in src/parse.rs, both imported from src/lib.rs — that walk the user's home directory with walkdir, build a zip archive via zip::ZipWriter including wallet artefacts (e.g. `exodus.wallet`), and upload the archive via reqwest multipart to a hardcoded Telegram Bot API endpoint using embedded `API_` token and `chat_id` constants. Both payload files (parse.rs ~40KB, test.rs ~60KB) are padded with roughly a hundred nonsense filler functions with invented identifiers (Modemir65, mix_wisp_30, Flagzelk147, shuffle_zelkvak_73, etc.) surrounding the exfiltration functions at the end of each file, consistent with deliberate camouflage. The dependency set — evdev and rdev (keyboard capture), winreg plus winapi winuser/processthreadsapi/memoryapi (Windows registry and process/memory primitives), walkdir, zip, and reqwest with the multipart feature — extends the capability surface to cross-platform keylogging and Windows persistence. The crate description `Это учебный проект для тестирования кибербезопасности` (\"educational project for cybersecurity testing\") does not match the shipped behavior.\n","affected":[{"package":{"name":"hesk","ecosystem":"crates.io","purl":"pkg:cargo/hesk"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/test.rs","sha256":"88d81962e8d5d31e64a152a3d0119e3e9522d00003d54f7be3a033cf5f3ef697","tlsh":"3243434b49f30969b023f8bd575fb9023134895f490dde957e7c6320af0a0a956f2af8"},{"path":"src/parse.rs","sha256":"6bf6443ffb37ce3a2501ff9ae7310d94a83387e7c61915b7f465dbb5a44949c0","tlsh":"7103534558f60875a057f8ad1b4eb813762849af1a0dfe147ebc23309f4b0695af1fd8"},{"path":"Cargo.toml","sha256":"933a826e1909f631bece7ab65e900392c8984040defd04fb01cbc517d7d6ac86","tlsh":"4331333e620afb362d5732e0889d65e60fe33109255daa6496dbc05c3e4c6cec2fc835"}],"package_integrity":[{"filename":"hesk-0.1.0.crate","hashes":{"sha256":"09bc0f16645e5dcc64f9a73d93e032bf4d347192ed541b9aeddfba7c87e68419"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/hesk/MAL-2026-19201.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hesk/0.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022651","import_time":"2026-11-12T22:10:48.400085278Z","modified_time":"2026-11-12T21:47:28Z","sha256":"83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0504","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:49.815536430Z","aliases":["CVE-2026-123601","GHSA-588m-chg6-8jqj","RUSTSEC-2026-0506"],"summary":"Inverted NSEC3 comparison in DNSSEC validation (hickory-proto 0.25)","details":"In hickory-proto 0.25.0 through 0.26.0-alpha.1, DNSSEC validation handled the last NSEC3 record of a zone's hash chain with its two comparisons reversed. That record was treated as covering almost every hash it does not cover, so an attacker who can answer or modify DNS responses could replay it, with its RRSIG, to forge proofs that existing names have no records.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in hickory-proto 0.25 (directly or through hickory-resolver or hickory-recursor 0.25) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0504.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0504.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/87ee4f81aa9689d81847770d3a74e13982c9bcdc"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0505","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38.251619656Z","aliases":["CVE-2026-123580","GHSA-p2jv-r3m3-7wf4","RUSTSEC-2026-0509"],"summary":"NSEC3 owner names not checked against the zone in DNSSEC validation (hickory-proto)","details":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation matched NSEC3 records to a name only by the hashed first label of the NSEC3 owner name, without checking that the rest of the owner name was the zone in question. A signed NSEC3 record from any zone the attacker controls could therefore be used, by someone who can answer or modify DNS responses, to prove that a name in another zone does not exist.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0505.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0505.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/10840b8432feb08d369f82e2bb6ce99ae23d7afa"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0506","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:49.815536430Z","aliases":["CVE-2026-123601","GHSA-588m-chg6-8jqj","RUSTSEC-2026-0504"],"summary":"Inverted NSEC3 comparison lets one record \"prove\" that almost any name does not exist","details":"When DNSSEC validation looks for the NSEC3 record that covers a hashed name, the last record in the zone's hash chain needs special handling, because its next hashed owner name sorts before its own hash. For that record the two comparisons were reversed: it was treated as covering every hash below its owner hash or above its next hash, which is mostly the part of the chain it does not cover.\n\nAn attacker who can answer or modify DNS responses can replay that one signed NSEC3 record, with its RRSIG, from the target zone and use it in forged negative answers. The validator then accepts proof that names which do exist have no records.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` (resolver, recursor and client) when built with `dnssec-ring` or `dnssec-aws-lc-rs`. The same code was in hickory-proto before it moved to hickory-net.\n\nThe fix corrects the comparison in `find_covering_record`. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0506.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0506.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/87ee4f81aa9689d81847770d3a74e13982c9bcdc"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0507","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:00:04.072693821Z","aliases":["CVE-2026-123605","GHSA-2vgh-3wfw-qj7c"],"summary":"RRSIG signer name was not checked against the zone of the signed records","details":"DNSSEC validation checked an RRset against the DNSKEYs of whatever zone was named in the RRSIG's Signer's Name field. RFC 4035 section 5.3.1 requires that name to be the zone that contains the RRset, but this was not checked.\n\nAnyone who controls a DNSSEC-signed zone, and can answer or modify DNS responses, can therefore sign records for names in an unrelated zone with their own keys and have the validator accept them as secure.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` (resolver, recursor and client) when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix ignores an RRSIG whose signer name is not the RRset's owner name or one of its ancestors. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0507.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0507.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/019535e011131c52d19cb6a2c7a2d31270271135"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0508","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:00:04.065164795Z","aliases":["CVE-2026-123587","GHSA-qw83-5pm2-ggp5"],"summary":"NSEC wraparound detection trusted an unvalidated SOA record","details":"The last NSEC record in a zone points back to the zone apex. To recognise it, DNSSEC validation treated an NSEC record as covering every name after its owner when its next domain name equalled the owner name of an SOA record in the response. That SOA record did not have to pass validation.\n\nAn attacker who can answer or modify DNS responses can replay a genuine NSEC record and its RRSIG, add a forged SOA record whose name equals that NSEC record's next domain name, and so make the validator accept that any name sorting after the NSEC owner does not exist.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix recognises a wraparound NSEC record from the chain itself (its next domain name sorts at or before its owner and is the zone of the queried name) and only uses validated SOA records. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0508.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0508.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/e5ca40a7ef149ba5a79bc6f4916f114d153ce9ab"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0509","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38.251619656Z","aliases":["CVE-2026-123580","GHSA-p2jv-r3m3-7wf4","RUSTSEC-2026-0505"],"summary":"NSEC3 records from another zone were accepted in proofs of nonexistence","details":"When DNSSEC validation used NSEC3 records to prove that a name or record type does not exist, it compared only the hashed first label of each NSEC3 owner name with the hash of the name being checked. The rest of the owner name, which says which zone the record belongs to, was not checked.\n\nSomeone who controls any DNSSEC-signed zone can publish a signed NSEC3 record whose first label is the hash of a name in another zone. An attacker who can answer or modify DNS responses can then use it to make the validator accept that the name in the other zone does not exist.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix requires a matching NSEC3 record to belong to a zone that contains the checked name, and ignores NSEC3 records whose owner is not directly below the RRSIG signer name. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0509.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0509.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/10840b8432feb08d369f82e2bb6ce99ae23d7afa"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/d2ee774a789193010f109d3d463adf72c4c261ab"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0510","published":"2026-11-11T12:00:00Z","modified":"2026-11-12T14:30:06.142752344Z","aliases":["GHSA-pqp6-f7wc-6498"],"summary":"Panic when decoding malformed Ed25519 keys from Base64","details":"In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::from_base64() and\nEd25519SecretKey::from_base64() panic on malformed input instead of returning an\nerror, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes.\nAn attacker who can supply a key to an application using vodozemac can crash it.\n\n## Impact\n\nEd25519 public keys are routinely received from other Matrix users and servers,\nso a malicious party can publish a crafted key that crashes clients parsing it.\n\nThe impact is limited to denial of service; no key disclosure or signature\nforgery is possible.","affected":[{"package":{"name":"vodozemac","ecosystem":"crates.io","purl":"pkg:cargo/vodozemac"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.11.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["vodozemac::Ed25519PublicKey::from_base64","vodozemac::Ed25519SecretKey::from_base64"],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0510.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/vodozemac"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0510.html"},{"type":"WEB","url":"https://github.com/matrix-org/vodozemac/pull/453"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0511","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:42.050905197Z","aliases":["CVE-2026-123594","GHSA-86vr-jm6c-7cpg","RUSTSEC-2026-0519"],"summary":"NXDOMAIN accepted for a proven empty non-terminal (hickory-proto)","details":"Up to 0.26.0-alpha.1, hickory-proto's NSEC validation accepted an NXDOMAIN response as secure even when the covering NSEC record's next domain name was below the queried name, which proves the name exists as an empty non-terminal. Because the response code is not signed, someone who can modify DNS responses could turn a genuine signed NODATA response into an accepted NXDOMAIN.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0511.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0511.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/bfbe7ede4021965526f065be9b415945ce575e29"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0512","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:54.645975781Z","aliases":["CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0520"],"summary":"DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)","details":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine signed RRset for another name or type and have it accepted as a validated answer.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0512.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0512.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0513","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:30:06.796669440Z","aliases":["CVE-2026-123604","GHSA-6w6g-hm98-mhgm"],"summary":"Unbounded retries on truncated responses in the name server pool","details":"When an upstream answer had the TC (truncated) bit set, the resolver's name server pool disabled UDP and sent the query again. It did this for every truncated answer, including answers that already came over TCP, and it kept no count of retries.\n\nA name server that sets TC on every answer, which anyone running an authoritative server the resolver queries can do, kept each lookup re-sending queries over the same connection until the request deadline (5 seconds by default) ran out. This uses up resolver resources and sends many queries per lookup.\n\nFrom 0.26.2 a truncated answer received after UDP has already been disabled ends the lookup with `NetError::Truncated` instead of retrying again.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0513.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0513.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/f9a7bc5d188e5b680b09aea91009d2fbf3fec58a"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
Loaded 100 of 167 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user