Osidb Bzimport

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** The PlayStation TIM loader, which handles PlayStation image files, contains an integer overflow when calculating the size of the Color Look-Up Table (CLUT). This occurs during the multiplication of the `num colors` and `num cluts` variables, both of which are 16-bit unsigned short integers. A specially crafted image file can trigger this overflow, leading to undefined behavior and causing the plug-in to abort, which results in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw in the `org.keycloak.broker.oidc` package causes the OIDC broker to incorrectly synchronize the `email verified` claim. When an OIDC identity provider is configured with `trustEmail=true` and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but takes the `email verified` status solely from the `id token`. Because there is no validation to ensure the `email verified` claim in the `id token` corresponds to the email address from the userinfo endpoint, a `email verified=true` claim from the `id token` can be applied to a different email address returned by the userinfo endpoint. This occurs if an attacker controls or compromises the upstream OIDC provider. This can lead to arbitrary email addresses being marked as verified in the database, bypassing email-based security controls, or potential account takeover if the application relies on the `email verified` flag for account linking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, set `trustEmail` to false for OIDC identity providers or disable the userinfo endpoint.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the `ClientResource` component of the admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator with limited control over specific clients to attach or remove hidden client scopes they are not authorized to manage. This could enable an attacker to inject unauthorized data or permissions into security tokens issued to end-users, potentially leading other applications to grant higher access levels than intended. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPLIP (affected versions not specified) **Description** An integer overflow exists in the `hpcups` processing path when handling specially crafted print data. This flaw may allow a remote attacker to escalate privileges or achieve arbitrary code execution. An integer overflow occurs when an arithmetic operation results in a value that exceeds the storage capacity of the integer type used to hold it, potentially leading to memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A heap buffer overflow exists in the Paint Shop Pro (PSP) file format parser. The issue occurs when the software incorrectly calculates buffer sizes while processing low bit-depth images, which leads to the overwriting of adjacent memory. A remote attacker can exploit this by tricking a user into opening a specially crafted PSP image file, potentially resulting in arbitrary code execution or a denial of service (DoS). **Recommendations** Update GIMP to the patched build provided by your distribution.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An issue in the administrative interface occurs when Fine-Grained Admin Permissions (FGAP v2) are enabled. An administrator with permission to view a specific role can access a list of all groups assigned to that role because the system fails to verify if the administrator has the necessary permissions to view those specific groups. This allows restricted administrators to discover hidden groups and access metadata, including internal names and custom settings, which may contain sensitive deployment information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Feast Feature Server (affected versions not specified) **Description** An unauthenticated remote attacker can write arbitrary JSON files to the server filesystem via the `/save-document` endpoint. The issue stems from improper input validation that allows a path restriction bypass, enabling the attacker to escape the intended save directory and overwrite critical application configurations or startup scripts. This could result in unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution if the written files are subsequently executed or loaded by the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/save-document` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the Identity Provider (IdP) mapper component, which manages the mapping of user information from external services to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this by creating a "Hardcoded Role" mapper to assign high-level administrative roles, such as `realm-admin`, to themselves or other users. This allows a restricted administrator to bypass security checks and obtain full control over the entire realm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw in `org.keycloak.authorization` allows an authenticated user who possesses a User-Managed Access (UMA) permission ticket for a single resource to bypass per-resource access control. By using a specific permission request prefix, the user can gain unauthorized access to all resources of the same type within the same resource server. This occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with `ownerManagedAccess` enabled that lack an explicit protecting policy. This can lead to unauthorized information disclosure or modification of resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apicurio Registry (affected versions not specified) **Description** A flaw exists in the `DocumentBuilderAccessor` where DOCTYPE declarations are not disabled and `FEATURE SECURE PROCESSING` is not enabled. Although external DTD and schema access are blocked, an attacker with artifact-write permissions can upload XML documents containing internal entity-expansion payloads, such as the billion-laughs variant. This can lead to CPU and heap exhaustion, though the JAXP default limit of 64,000 entity expansions provides partial mitigation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** A CPU exhaustion Denial of Service (DoS) occurs due to superlinear (approximately O(n²)) behavior in the `parse link text()` function. When processing Markdown containing numerous consecutive [ characters, the function repeatedly scans the input using a regex search within a loop, re-scanning large portions of the remaining string in each iteration. This quadratic-time behavior allows an attacker to trigger excessive CPU usage using a small payload. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A regression occurred when a rework commit replaced specific overflow checks with a general signed comparison. This issue is triggered when a client sends a Range request with a suffix length that exceeds the content size. Because the resulting negative start value is not properly clamped, the system generates malformed HTTP 206 responses and causes log flooding. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSH (affected versions not specified) **Description** A double free flaw exists in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. A malicious SSH server can exploit this to cause client-side process termination, leading to a Denial of Service (DoS). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSH (affected versions not specified) **Description** A flaw in OpenSSH allows a local unprivileged attacker on a Linux client host to hijack client-side X11 forwarding connections. This occurs when X11 forwarding is enabled and a local UNIX-domain X socket is used, allowing the attacker to pre-bind the preferred abstract X socket name. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may enable manipulation of the forwarded session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Katello of Red Hat Satellite (affected versions not specified) **Description** Insufficient authorization checks in the `ContentUploadsController` within the content upload functionality allow authenticated users with the `edit products` permission to query content information for repositories they are not authorized to manage. This allows an attacker to determine if specific content exists within otherwise inaccessible repositories, although it does not permit unauthorized modification, import, or publication of content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ChromaDB versions 0.4.17 through 0.4.16 **Description** An authenticated attacker with the UPDATE COLLECTION permission can execute arbitrary code on the server. This occurs by sending a malicious model repository and setting the `trust remote code` variable to true via the "/api/v2/tenants/default tenant/databases/default database/collections/{collection id}" endpoint. **Recommendations** Update to a version prior to 0.4.17.

**Name of the Vulnerable Software and Affected Versions** Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 **Description** An incomplete fix for a previous issue allows untrusted users who can configure the Java Message Service (JMS), a Java API for creating, administering, and managing messaging systems, to achieve arbitrary code execution. This flaw can lead to a complete compromise of the affected system. **Recommendations** Upgrade to version 4.2.2. Upgrade to version 4.1.7.

**Name of the Vulnerable Software and Affected Versions** ChromaDB (affected versions not specified) **Description** All V1 collection-level endpoints in the Python project pass null values for the `tenant` and `database` variables to the authorization layer. This flaw allows a remote attacker to bypass authorization controls, potentially resulting in unauthorized access and a high impact on data confidentiality and integrity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins versions prior to 2.568 Jenkins LTS versions prior to 2.555.3 **Description** A deserialization flaw exists in Jenkins due to deficiencies in the XStream library mechanism. By submitting a specially crafted `config.xml` file, an attacker can force the system to deserialize arbitrary types defined in the Jenkins core or plugins. This allows the attacker to bypass the `ClassFilter` (a JEP-200 implementation) by using permitted classes as gadgets, such as `hudson.Plugin$DummyImpl`. Exploitation enables the attacker to impersonate any user and send HTTP requests on their behalf. This can lead to arbitrary code execution via the Script Console or the unauthorized reading of arbitrary files from the Jenkins controller. Real-world exploitation has been observed against honeypots, targeting CI/CD credentials, pipeline configurations, tokens, and application secrets. Technical details include the use of the following API endpoints: - `/config.xml` - `/createView` - `/view/{ViewName}/properties/0/{file}` Vulnerable parameters include `baseResourceURL` within the XML structure, which can be manipulated to access the server's root file system using the `file:/` construction via the Stapler framework (a Java framework that maps Java objects to URLs). **Recommendations** Update Jenkins to version 2.568 or later. Update Jenkins LTS to version 2.555.3 or later. Monitor server logs for suspicious requests to the `/view/{ViewName}/properties/0/{file}` endpoint, specifically those targeting sensitive files like `/etc/passwd`. Implement IDS/WAF rules to block POST requests to `/config.xml` or `/createView` that contain the `<hudson.Plugin -DummyImpl>` tag and the `<baseResourceURL>file:/</baseResourceURL>` string.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw exists during schema reload where the `attr syntax swap ht()` function unconditionally frees attribute syntax information nodes. This action bypasses the refcount-based deferred deletion mechanism used in the attribute syntax subsystem. If a schema reload is triggered while concurrent LDAP query traffic is active, worker threads may access freed memory, leading to a use-after-free or double-free condition, which results in a denial of service via a server crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.