Security Vulnerabilities - CVEs Published In 2022
Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value, which can either exhaust available memory or crash the whole program. When using `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size. When `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the length of the slice was previously read directly from the data itself without any checks on the size of it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with excessive size value. Users should upgrade to `v0.7.1` or higher. A workaround is not to rely on the `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and checks the length of any slice.
CVSS Score
8.8
EPSS Score
0.012
Published
2022-09-02
Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.
CVSS Score
7.2
EPSS Score
0.014
Published
2022-09-02
Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon Auto
CVSS Score
6.2
EPSS Score
0.001
Published
2022-09-02
Memory corruption in multimedia due to incorrect type conversion while adding data in Snapdragon Auto
CVSS Score
8.4
EPSS Score
0.001
Published
2022-09-02
Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto
CVSS Score
8.4
EPSS Score
0.001
Published
2022-09-02
Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto
CVSS Score
8.4
EPSS Score
0.001
Published
2022-09-02
Memory corruption due to buffer overflow occurs while processing invalid MKV clip which has invalid seek header in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score
7.3
EPSS Score
0.004
Published
2022-09-02
Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score
7.3
EPSS Score
0.004
Published
2022-09-02
Memory corruption due to buffer overflow while parsing MKV clips with invalid bitmap size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score
7.3
EPSS Score
0.004
Published
2022-09-02
Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score
7.3
EPSS Score
0.004
Published
2022-09-02