Kevinbackhouse

Exiv2 is a C++ library and a command-line utility used for reading, writing, deleting, and modifying Exif, IPTC, XMP, and ICC image metadata. A flaw exists in the CRW image parser that can lead to an out-of-bounds read. The issue is present in the `CrwMap::decode0x0805` function.

Exiv2 is a C++ library and a command-line utility used to read, write, delete, and modify image metadata (Exif, IPTC, XMP, and ICC). A flaw exists in the preview component where an integer overflow can occur when the utility is run with an extra command-line argument, such as -pp. This overflow leads to an attempt to create an excessively large `std::vector`, resulting in an uncaught exception and causing Exiv2 to crash.

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 25.06.0 Description: The issue is related to the use of `std::atomic int` for reference counting in the Poppler PDF rendering library. Since `std::atomic int` is only 32 bits, it is possible to overflow the reference count, which can trigger a use-after-free. Recommendations: For versions prior to 25.06.0, update to version 25.06.0 to resolve the issue.

A Remote Code Execution (ReDoS) vulnerability was discovered in the Giskard component. This issue can trigger exponential regex evaluation times when processing datasets with specific text patterns, potentially leading to denial of service. The vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection, where a regex used to detect URLs and links is vulnerable to catastrophic backtracking.

The issue is related to out-of-bounds array access in libcue, which provides an API for parsing and extracting data from CUE sheets. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to ~/Downloads, it is then automatically scanned by tracker-miners, and since it has a .cue filename extension, tracker-miners use libcue to parse the file, allowing the file to exploit the vulnerability in libcue to gain code execution.

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. The issues include polynomial time complexity in multiple components like autolink extension, handle close bracket, and parsing of certain text patterns (leading `>`, `-`, ` `). An out-of-bounds read in the `validate protocol` function was also identified.

The issue is related to a crafted markdown document that can trigger an out-of-bounds read in the `validate protocol` function. This bug is believed to be harmless in practice because the out-of-bounds read accesses `malloc` metadata without causing any visible damage. Additionally, there are issues with polynomial time complexity in multiple components, which may lead to unbounded resource exhaustion and denial of service.

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. The issue is related to several polynomial time complexity problems that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically.

The issue concerns a polynomial time complexity problem in cmark-gfm, which may lead to unbounded resource exhaustion and subsequent denial of service. This problem affects multiple components, including autolink extension, handle close bracket, and parsing of certain text patterns, such as those starting with `>`, `-`, or ` `. An out-of-bounds read was also identified in the `validate protocol` function, although it is considered less severe.

The Nextcloud News for Android app has a security issue where a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android.

The issue is related to a lack of division by zero check in the Exiv2 library, which can cause a denial of service when a specially crafted image file is used. An attacker could exploit this to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is triggered when printing the interpreted data, which requires an extra command line option (`-p t` or `-P t`).

A null pointer dereference was found in Exiv2, which can be triggered when printing the metadata of a crafted image file. This can potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when printing the interpreted (translated) data, which requires an extra command line option (`-p t` or `-P t`).

A null pointer dereference was found in Exiv2, which can be triggered when printing the metadata of a crafted image file. This can potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when printing the interpreted (translated) data, which requires an extra command line option (`-p t` or `-P t`).

An out-of-bounds read was found in Exiv2, a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file, specifically when printing the image ICC profile using the extra command line option `-p C`. An attacker could potentially exploit this issue to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file.

The issue is related to an infinite loop in Exiv2 when modifying the metadata of a crafted image file, potentially allowing an attacker to cause a denial of service. This bug is triggered when deleting the IPTC data, which requires an extra command line option (`-d I rm`). The vulnerability can be exploited by tricking the victim into running Exiv2 on a specially crafted image file.

The issue is related to an inefficient algorithm with quadratic complexity in Exiv2, which can be triggered when writing metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, a less frequently used operation than reading metadata.

An out-of-bounds read was found in Exiv2, triggered when it is used to write metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata. For example, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as `insert` is needed.

An out-of-bounds read was found in Exiv2 when used to write metadata into a crafted image file. This could potentially be exploited by an attacker to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata.

A heap buffer overflow was found in Exiv2 when used to write metadata into a crafted image file. This could potentially allow an attacker to gain code execution if they can trick the victim into running Exiv2 on a crafted image file. The issue is triggered by writing metadata, a less frequently used operation than reading metadata. For example, adding an extra command-line argument such as `insert` can trigger the bug in the Exiv2 command-line application. The vulnerability may also allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted image file.

The issue allows a local user to potentially create a new privileged account on Ubuntu and its derivatives by exploiting a vulnerability in the GNOME Display Manager (GDM) when it cannot contact the accountservice service via dbus in a timely manner. This can be chained with another issue to achieve privilege escalation. The vulnerability is resolved in GNOME 3.36.2 and 3.38.2.