Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 2 of 2
Mar 4, 2024libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode.CVE-2024-25269 · Other software · libheif · reported by MITREHigh 7.5
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.CVE-2023-49464 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.CVE-2023-49463 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.CVE-2023-49462 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.CVE-2023-49460 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc,CVE-2023-29659 · Other software · Struktur · reported by MITREMedium 6.5
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Feb 23, 2023 There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif.CVE-2023-0996 · Other software · Struktur · reported by cve_disclosure@tech.gov.sgHigh 7.8
There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgovtech-csg.github.io
Apr 12, 2022In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check.CVE-2021-39804 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-215002587
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 11, 2022Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of boCVE-2022-27574 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attacker.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of boCVE-2022-27573 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attackers.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote aCVE-2022-27571 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.1
Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackersCVE-2022-26098 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.1
Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 9, 2022HEIF Image Extensions Remote Code Execution VulnerabilityCVE-2022-24457 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEIF Image Extensions Remote Code Execution Vulnerability
- Product
- HEIF Image Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 3, 2021Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disCVE-2020-23109 · Other software · Struktur · reported by MITREHigh 8.1
Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in heif through through v3.6.2.CVE-2021-32289 · Other software · Nokia · reported by MITREMedium 5.5
An issue was discovered in heif through through v3.6.2. A NULL pointer dereference exists in the function convertByteStreamToRBSP() located in nalutil.cpp. It allows an attacker to cause Denial of Service.
- Product
- Heif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in heif through v3.6.2.CVE-2021-32288 · Other software · Nokia · reported by MITREHigh 7.8
An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicHeight() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.
- Product
- Heif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in heif through v3.6.2.CVE-2021-32287 · Other software · Nokia · reported by MITREHigh 7.8
An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicWidth() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.
- Product
- Heif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact dCVE-2020-19499 · Other software · Struktur · reported by MITREHigh 8.8
An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.CVE-2020-19498 · Other software · Struktur · reported by MITREHigh 8.8
Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition.CVE-2021-0432 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 11, 2020HEIF Image Extensions Remote Code Execution VulnerabilityCVE-2020-17101 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEIF Image Extensions Remote Code Execution Vulnerability
- Product
- HEIF Image Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 23, 2019libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existinCVE-2019-11471 · Other software · Struktur · reported by MITREHigh 8.8
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.