Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp.CVE-2022-35013 · Other software · Pngdec Project · reported by MITREMedium 6.5
PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via SaveBMP at /linux/main.cpp.CVE-2022-35012 · Other software · Pngdec Project · reported by MITREMedium 6.5
PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via SaveBMP at /linux/main.cpp.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate_fast at /src/inffast.c.CVE-2022-35011 · Other software · Pngdec Project · reported by MITREHigh 8.8
PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate_fast at /src/inffast.c.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via asan_interceptors_memintrinsics.cpp.CVE-2022-35010 · Other software · Pngdec Project · reported by MITREMedium 6.5
PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via asan_interceptors_memintrinsics.cpp.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan_malloc_linux.cpp.CVE-2022-35009 · Other software · Pngdec Project · reported by MITREMedium 6.5
PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan_malloc_linux.cpp.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a stack overflow via /linux/main.cpp.CVE-2022-35008 · Other software · Pngdec Project · reported by MITREMedium 6.5
PNGDec commit 8abf6be was discovered to contain a stack overflow via /linux/main.cpp.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via __interceptor_fwrite.part.57 at sanitizer_common_interceptors.inc.CVE-2022-35007 · Other software · Pngdec Project · reported by MITREMedium 6.5
PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via __interceptor_fwrite.part.57 at sanitizer_common_interceptors.inc.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2017FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.CVE-2017-7866 · Other software · Ffmpeg · reported by MITRECritical 9.8
FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugs.chromium.org
Apr 14, 2017FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.CVE-2017-7863 · Other software · Ffmpeg · reported by MITRECritical 9.8
FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugs.chromium.org
Sep 5, 2015The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, whCVE-2015-6818 · Other software · Ffmpeg · reported by MITREHigh 7.5
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordffmpeg.orggit.videolan.org
Dec 9, 2014The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denCVE-2014-9317 · Other software · Ffmpeg · reported by MITREHigh 7.5
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orglists.debian.org
Nov 5, 2014libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackeCVE-2014-8545 · Other software · Ffmpeg · reported by MITREHigh 7.5
libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orgffmpeg.org
Nov 23, 2013The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG iCVE-2013-0875 · Other software · Ffmpeg · reported by chrome-cve-admin@google.comHigh 9.3
The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG image, related to an out-of-bounds array access.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orgffmpeg.org
Jun 4, 2009Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer GoodCVE-2009-1932 · Other software · Gstreamer · reported by MITREMedium 6.8
Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow.
- Product
- Good Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orgosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.