Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.

A flaw was found in Exim. This vulnerability allows an attacker to perform directory traversal by mishandling arguments related to queue-name. This could enable unauthorized access to files outside of the designated spool area, potentially leading to a gain of privileges.

A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's certificate against its hostname, potentially enabling a man-in-the-middle (MITM) attack and leading to information disclosure.

A flaw was found in FFmpeg's `vf_quirc` filter, which handles subtitle processing. A remote attacker can exploit this heap out-of-bounds write vulnerability by providing a specially crafted PGS/SUP subtitle file. This file, with mismatched frame dimensions, can cause the software to write data beyond the allocated memory buffer. Successful exploitation can lead to heap corruption, a process crash, and potentially arbitrary code execution, allowing the attacker to run malicious code on the affected system.

A flaw was found in FFmpeg's native PNG and APNG encoders. A remote attacker can exploit this heap out-of-bounds write vulnerability by providing a specially crafted PNG image containing a malicious eXIf chunk. This can lead to heap memory corruption, a process crash, and potentially allow the attacker to execute arbitrary code on the affected system.

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF (Core Audio Format) file. This malicious file manipulates the bytes_per_packet value, leading to an undersized memory allocation and a heap out-of-bounds write. This vulnerability could allow an attacker to execute arbitrary code on the affected system.

A flaw was found in FFmpeg, specifically within the LCL/ZLIB video decoder. A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including sensitive data, which an attacker could observe in the AVFrame output. This information disclosure could potentially aid in bypassing Address Space Layout Randomization (ASLR) in long-running media processing services.

A flaw was found in FFmpeg. An uncontrolled resource consumption vulnerability exists in the IAMF demuxer. An unauthenticated attacker can exploit this by supplying a specially crafted input file with a malicious count_label field. This can cause the system to allocate a large amount of memory, leading to resource exhaustion and a denial of service.

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the `vf_hqdn3d` filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent larger frames can cause the application to write beyond these allocated boundaries, leading to heap memory corruption. This can result in arbitrary code execution or a denial of service.

A flaw was found in libssh2. A malicious SSH server can exploit a pre-authentication heap buffer overflow vulnerability by sending a specially crafted packet during the Encrypt-then-MAC (ETM) cipher negotiation. This allows the server to corrupt heap memory, potentially leading to arbitrary code execution on the connecting client before authentication is complete.

A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution.

A flaw was found in libssh2. A pre-authentication integer underflow vulnerability exists in the `ssh2_cipher_crypt()` function when negotiating AES-GCM ciphers during the handshake. A malicious SSH server can exploit this to trigger an out-of-bounds read and a memory copy operation with an extremely large length argument, leading to an immediate client process crash. This vulnerability results in a Denial of Service (DoS) for any connecting client.

A flaw was found in libssh2. A malicious SSH (Secure Shell) server can exploit a double-free vulnerability in the sftp_open() function. This flaw allows the server to corrupt the heap memory of an authenticated client when it opens an SFTP (SSH File Transfer Protocol) session. This heap corruption can lead to arbitrary code execution on the client system, giving the attacker control over the affected system.

A flaw was found in ImageMagick. This memory leak vulnerability occurs when invalid options are provided to the magick command-line interface (CLI). An attacker can exploit this by repeatedly supplying malformed command-line arguments, leading to memory exhaustion and a denial of service (DoS) on the affected system.

A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting (XSS) attacks. An attacker could exploit this to execute malicious scripts in a user's browser, potentially leading to information disclosure or unauthorized actions.

A flaw was found in Diffusers. This path traversal vulnerability in the `_get_checkpoint_shard_files` function allows a remote attacker to read arbitrary files. By supplying malicious `weight_map` values in model index JSON, an attacker can use `../` sequences or absolute paths to escape the model directory and read sensitive files outside the intended location during model loading. This could lead to information disclosure.