netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-g4m4-9q4c-mfw6
GHSA-q5fm-55c2-v6j9
This commit is contained in:
advisory-database[bot]
2024-08-21 22:31:17 +00:00
parent 3eb3852127
commit 3ae65d66ec
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/07/GHSA-g4m4-9q4c-mfw6/GHSA-g4m4-9q4c-mfw6.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g4m4-9q4c-mfw6",
"modified": "2024-07-16T19:32:22Z",
"modified": "2024-08-21T22:30:00Z",
"published": "2024-07-16T19:32:22Z",
"aliases": [
],
"summary": "Fiona affected by CVE-2020-14152 related to madler-zlib",
"details": "### Summary\nVulnerability scan of fiona shows [CVE-2020-14152](https://nvd.nist.gov/vuln/detail/CVE-2020-14152)\n\n### Details\nIn IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.\n\n### Impact\nUnkown. Please document if this vulnerability is exposed\n",
"details": "### Summary\nVulnerability scan of fiona shows [CVE-2020-14152](https://nvd.nist.gov/vuln/detail/CVE-2020-14152). The vulnerability is in libjpeg, a transitive dependency of fiona (via GDAL and PROJ).\n\n### Details\nIn IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.\n\n### Impact\nfiona will not open JPEG files and is not vulnerable to attack in that way. fiona might be vulnerable to malformed PROJ grid files using JPEG compression. No such vulnerability or compromise has been demonstrated.\n",
"severity": [
{
"type": "CVSS_V3",
advisories/github-reviewed/2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q5fm-55c2-v6j9",
"modified": "2024-07-16T19:32:45Z",
"modified": "2024-08-21T22:30:04Z",
"published": "2024-07-16T19:32:45Z",
"aliases": [
],
"summary": "Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib",
"details": "### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853)\n\n### Details\nfiona depends on madler-zlib 1.3. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n\n### Impact\nUnkown. Please document if this vulnerability is exposed\n",
"details": "### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.",
"severity": [
{
"type": "CVSS_V3",