Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
53 results · page 1 of 2
Oct 14, 2026libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks theCVE-2026-110601 · Other software · saitoha · reported by VulnCheckMedium 5.8
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-44638 · Other software · saitoha · reported by GitHubLow 2.5
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-44637 · Other software · saitoha · reported by GitHubHigh 7.1
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-44636 · Other software · saitoha · reported by GitHubHigh 7.4
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-33023 · Other software · saitoha · reported by GitHubHigh 7.8
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built with the --with-gdk-pixbuf2 option, a use-after-free vulnerability exists in load_with_gdkpixbuf() in loader.c. The cleanup path manually frees the sixel_frame_t object and its internal buffers without consulting the reference count, even though the object was created via the refcounted constructor sixel_frame_new() and exposed to the public callback. A callback that calls sixel_frame_ref(frame) to retain a logically valid reference will hold a dangling pointer after sixel_helper_load_image_file() returns, and any subsequent access to the frame or its fields triggers a use-after-free confirmed by AddressSanitizer. The root cause is a consistency failure between two cleanup strategies in the same codebase: sixel_frame_unref() is used in load_with_builtin() but raw free() is used in load_with_gdkpixbuf(). An attacker supplying a crafted image to any application built against libsixel with gdk-pixbuf2 support can trigger this reliably, potentially leading to information disclosure, memory corruption, or code execution. This issue has been fixed in version 1.8.7-r1.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-33021 · Other software · saitoha · reported by GitHubHigh 7.3
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-33020 · Other software · saitoha · reported by GitHubHigh 7.1
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution. This issue has been fixed in version 1.8.7-r1.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-33019 · Other software · saitoha · reported by GitHubHigh 7.1
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds heap read in the --crop option handling of img2sixel, where positive coordinates up to INT_MAX are accepted without overflow-safe bounds checking. In sixel_encoder_do_clip(), the expression clip_w + clip_x overflows to a large negative value when clip_x is INT_MAX, causing the bounds guard to be skipped entirely, and the unclamped coordinate is passed through sixel_frame_clip() to clip(), which computes a source pointer far beyond the image buffer and passes it to memmove(). An attacker supplying a specially crafted crop argument with any valid image can trigger an out-of-bounds read in the heap, resulting in a reliable crash and potential information disclosure. This issue has been fixed in version 1.8.7-r1.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.CVE-2026-33018 · Other software · saitoha · reported by GitHubHigh 7
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a Use-After-Free vulnerability via the load_gif() function in fromgif.c, where a single sixel_frame_t object is reused across all frames of an animated GIF and gif_init_frame() unconditionally frees and reallocates frame->pixels between frames without consulting the object's reference count. Because the public API explicitly provides sixel_frame_ref() to retain a frame and sixel_frame_get_pixels() to access the raw pixel buffer, a callback following this documented usage pattern will hold a dangling pointer after the second frame is decoded, resulting in a heap use-after-free confirmed by ASAN. Any application using sixel_helper_load_image_file() with a multi-frame callback to process user-supplied animated GIFs is affected, with a reliable crash as the minimum impact and potential for code execution. This issue has been fixed in version 1.8.7-r1.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.CVE-2025-61146 · Other software · Saitoha · reported by MITREMedium 4
saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 21, 2025A vulnerability was found in saitoha libsixel up to 1.10.3.CVE-2025-9300 · Other software · saitoha · reported by VulDBLow 1.9
A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.
- Product
- libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 11, 2022There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6.CVE-2022-29978 · Other software · Saitoha · reported by MITREMedium 6.5
There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6.CVE-2022-29977 · Other software · Saitoha · reported by MITREMedium 6.5
There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.CVE-2021-40656 · Other software · Libsixel · reported by MITREHigh 8.8
libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.CVE-2022-27046 · Other software · Saitoha · reported by MITREHigh 8.8
libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876.CVE-2022-27044 · Other software · Saitoha · reported by MITREHigh 8.8
libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379.CVE-2021-41715 · Other software · Libsixel · reported by MITREHigh 8.8
libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.CVE-2022-27938 · Other software · Libsixel · reported by MITREMedium 5.5
stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.CVE-2021-46700 · Other software · Saitoha · reported by MITREMedium 6.5
In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DCVE-2021-45340 · Other software · Libsixel · reported by MITREMedium 6.5
In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.CVE-2020-21548 · Other software · Saitoha · reported by MITREHigh 8.8
Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.CVE-2020-21547 · Other software · Saitoha · reported by MITREHigh 8.8
Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2021Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.CVE-2020-21050 · Other software · Saitoha · reported by MITREMedium 6.5
Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgcwe.mitre.org
Sep 14, 2021An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.CVE-2020-21049 · Other software · Saitoha · reported by MITREMedium 6.5
An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orggithub.com
Sep 14, 2021An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.CVE-2020-21048 · Other software · Saitoha · reported by MITREMedium 6.5
An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orggithub.com
Aug 10, 2021A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a denial of service (DOCVE-2020-21677 · Other software · Saitoha · reported by MITREMedium 6.5
A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a denial of service (DOS) via converting a crafted PNG file into Sixel format.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).CVE-2020-36120 · Other software · Saitoha · reported by MITREHigh 7.5
Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2020Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.CVE-2020-19668 · Other software · Saitoha · reported by MITREMedium 6.5
Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2020load_png in loader.c in libsixel.a in libsixel 1.8.6 has an uninitialized pointer leading to an invalid call to free, which can cause a denial of service.CVE-2020-11721 · Other software · Saitoha · reported by MITREMedium 6.5
load_png in loader.c in libsixel.a in libsixel 1.8.6 has an uninitialized pointer leading to an invalid call to free, which can cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2020libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.CVE-2019-20205 · Other software · Saitoha · reported by MITREHigh 8.8
libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2019An issue was discovered in libsixel 1.8.4.CVE-2019-20140 · Other software · Saitoha · reported by MITREHigh 8.8
An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2019An issue was discovered in libsixel 1.8.4.CVE-2019-20094 · Other software · Saitoha · reported by MITREHigh 8.8
An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_init_frame at fromgif.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2019stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.CVE-2019-20056 · Other software · Nothings · reported by MITREMedium 6.5
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019A heap-based buffer overflow was discovered in image_buffer_resize in fromsixel.c in libsixel before 1.8.4.CVE-2019-20024 · Other software · Saitoha · reported by MITREMedium 6.5
A heap-based buffer overflow was discovered in image_buffer_resize in fromsixel.c in libsixel before 1.8.4.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019A memory leak was discovered in image_buffer_resize in fromsixel.c in libsixel 1.8.4.CVE-2019-20023 · Other software · Saitoha · reported by MITREMedium 6.5
A memory leak was discovered in image_buffer_resize in fromsixel.c in libsixel 1.8.4.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3.CVE-2019-20022 · Other software · Saitoha · reported by MITREMedium 6.5
An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2019An issue was discovered in libsixel 1.8.2.CVE-2019-19778 · Other software · Saitoha · reported by MITREHigh 8.8
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2019stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.CVE-2019-19777 · Other software · Nothings · reported by MITREHigh 8.8
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2019An issue was discovered in libsixel 1.8.2.CVE-2019-19638 · Other software · Saitoha · reported by MITRECritical 9.8
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2019An issue was discovered in libsixel 1.8.2.CVE-2019-19637 · Other software · Saitoha · reported by MITRECritical 9.8
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2019An issue was discovered in libsixel 1.8.2.CVE-2019-19636 · Other software · Saitoha · reported by MITRECritical 9.8
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2019An issue was discovered in libsixel 1.8.2.CVE-2019-19635 · Other software · Saitoha · reported by MITRECritical 9.8
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2019The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion.CVE-2019-11024 · Other software · Saitoha · reported by MITREMedium 5.5
The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.loginsoft.com
Jan 2, 2019In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.CVE-2019-3574 · Other software · Saitoha · reported by MITREHigh 7.8
In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2019In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.CVE-2019-3573 · Other software · Saitoha · reported by MITREMedium 5.5
In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2018There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19763 · Other software · Saitoha · reported by MITREMedium 5.5
There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8.2 that will cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 29, 2018There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel 1.8.2 that will cause a denial of service or possibly unspecifiCVE-2018-19762 · Other software · Saitoha · reported by MITREHigh 7.8
There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel 1.8.2 that will cause a denial of service or possibly unspecified other impact.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 29, 2018There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19761 · Other software · Saitoha · reported by MITREMedium 5.5
There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1.8.2 that will cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 29, 2018There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19759 · Other software · Saitoha · reported by MITREMedium 5.5
There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 29, 2018There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19757 · Other software · Saitoha · reported by MITREMedium 6.5
There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that will cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.