CVE-2022-45887

kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H300s Firmware and 11 more

CVE-2024-21789

BIG-IP ASM and Advanced WAF vulnerability

When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Advanced Web Application Firewall Big-ip Application Security Manager

CVE-2022-21698

Uncontrolled Resource Consumption in promhttp

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

CVSS 3.1 · 7.5 High EPSS 6.0% KEV · Not listed

Vendors

Fedoraproject Prometheus Rdo Project and 1 more

Products

Extra Packages For Enterprise Linux Fedora Client Golang and 14 more

CVE-2022-41952

Uncontrolled Resource Consumption in Matrix Synapse

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Matrix

Products

Synapse

CVE-2017-9936

libtiff: memory leak in tif_jbig.c

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

CVSS 3.0 · 6.5 Medium EPSS 7.5% KEV · Not listed

Vendors

Canonical Debian Libtiff

Products

Ubuntu Linux Debian Linux Libtiff

CVE-2017-9440

ImageMagick: Memory leak in the ReadPSDChannel function

In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2017-9439

ImageMagick: Memory leak in the ReadPDBImage function

In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2017-9409

ImageMagick: Memory leak in the ReadMPCImage function

In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2017-9408

poppler: Memory leak in the Object::initArray function

In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Freedesktop

Products

Debian Linux Poppler

CVE-2017-9407

ImageMagick: Memory leak in the ReadPALMImage function

In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2017-9406

poppler: Memory leak in the gmalloc function in gmem.cc

In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Freedesktop

Products

Debian Linux Poppler

CVE-2017-9405

ImageMagick: Memory leak in the ReadICONImage function

In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2017-9404

libtiff: Memory leak in OJPEGReadHeaderInfoSecTablesQTable

In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Canonical Debian Libtiff

Products

Ubuntu Linux Debian Linux Libtiff

CVE-2017-9403

libtiff: Memory leak in TIFFReadDirEntryLong8Array

In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Canonical Debian Libtiff

Products

Ubuntu Linux Debian Linux Libtiff

CVE-2017-9060

Qemu: virtio-gpu: host memory leakage in Virtio GPU device

Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2017-9059

kernel: Module reference leak due to improper shut down of callback channel on umount

The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem, aka a "module reference and kernel daemon" leak.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2017-8925

kernel: Reference count mishandling in the omninet_open function

The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-8421

binutils: Memory exhaustion in objdump via a crafted PE file

The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Binutils

CVE-2017-8086

Qemu: 9pfs: host memory leakage via v9pfs_list_xattr

Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2017-7943

ImageMagick: Memory leak in ReadSVGImage

The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed

Vendors

Debian Imagemagick

Products

Debian Linux Imagemagick