Fedoraproject Fedora vulnerabilities

CVE-2022-2963 [HIGH] CWE-401 CVE-2022-2963: A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentation fault.

CVE-2019-19005 [HIGH] CVE-2019-19005: A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact v A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182.

CVE-2022-2982 [HIGH] CWE-416 CVE-2022-2982: Use After Free in GitHub repository vim/vim prior to 9.0.0260. Use After Free in GitHub repository vim/vim prior to 9.0.0260.

CVE-2022-2862 [HIGH] CWE-416 CVE-2022-2862: Use After Free in GitHub repository vim/vim prior to 9.0.0221. Use After Free in GitHub repository vim/vim prior to 9.0.0221.

CVE-2021-42612 [HIGH] CWE-416 CVE-2021-42612: A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentati A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have other unspecified impact via a crafted text document.

CVE-2020-19752 [HIGH] CWE-476 CVE-2020-19752: The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference. The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.

CVE-2020-16154 [HIGH] CWE-347 CVE-2020-16154: The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.

CVE-2021-35561 [MEDIUM] CVE-2021-35561: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compr

CVE-2023-4752 [HIGH] CWE-416 CVE-2023-4752: Use After Free in GitHub repository vim/vim prior to 9.0.1858. Use After Free in GitHub repository vim/vim prior to 9.0.1858.

CVE-2022-3296 [HIGH] CWE-121 CVE-2022-3296: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

CVE-2021-35586 [MEDIUM] CVE-2021-35586: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compr

CVE-2022-3324 [HIGH] CWE-121 CVE-2022-3324: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.

CVE-2023-0433 [HIGH] CWE-122 CVE-2023-0433: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

CVE-2023-4750 [HIGH] CWE-416 CVE-2023-4750: Use After Free in GitHub repository vim/vim prior to 9.0.1857. Use After Free in GitHub repository vim/vim prior to 9.0.1857.

CVE-2023-4733 [HIGH] CWE-416 CVE-2023-4733: Use After Free in GitHub repository vim/vim prior to 9.0.1840. Use After Free in GitHub repository vim/vim prior to 9.0.1840.

CVE-2023-41358 [HIGH] CWE-476 CVE-2023-41358: An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attri An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

CVE-2022-29824 [MEDIUM] CWE-190 CVE-2022-29824: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is af

CVE-2014-3219 [HIGH] CWE-59 CVE-2014-3219: fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fi fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.

CVE-2016-5384 [HIGH] CWE-415 CVE-2016-5384: fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary fr fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

CVE-2019-5819 [HIGH] CWE-20 CVE-2019-5819: Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allo Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafted string copied to clipboard.