Zdi

A flaw exists in GIMP’s parsing of XWD files, leading to a potential out-of-bounds write. This can allow a remote attacker to execute arbitrary code on systems running affected versions of GIMP. User interaction is required, as the target must open a malicious file or visit a malicious page. The issue stems from insufficient validation of user-supplied data, which can lead to writing beyond the bounds of an allocated buffer. An attacker could exploit this to execute code within the current process.

A flaw exists in the parsing of XCF files within GIMP, leading to a use-after-free condition. This allows remote attackers to potentially execute arbitrary code on affected systems. User interaction is required, specifically the need for a target to open a malicious file or visit a malicious page. The issue stems from a lack of validation to confirm the existence of an object before operations are performed on it, which an attacker can exploit to execute code within the current process.

The PDFsam Enhanced App contains an out-of-bounds read issue that can lead to remote code execution. The issue was discovered by ZDI.

A flaw exists in PDFsam Enhanced related to the processing of XLS files. This allows a remote attacker to execute arbitrary code on affected systems. User interaction is required, specifically the target must open a malicious file or visit a malicious page. The issue stems from the execution of dangerous scripts without providing a warning to the user, enabling an attacker to execute code with the privileges of the current user.

A flaw exists in the parsing of PDF files within Soda PDF Desktop. The issue stems from insufficient validation of user-supplied data, potentially leading to a read past the end of an allocated object. An attacker could leverage this, potentially in combination with other issues, to disclose sensitive information. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger the issue.

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole (affected versions not specified) Description: This issue allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole without requiring authentication. The problem lies in the implementation of the `decryptFile` method, which lacks proper validation of a user-supplied path before using it in file operations. This can be exploited to write files in the context of SYSTEM. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.