From a703fceba73416a8ce985a58a9b534387cf06ff5 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 21 Apr 2025 00:31:26 +0000 Subject: [PATCH] Publish Advisories GHSA-3cxc-phxh-65vq GHSA-3w5w-m35v-rfp7 GHSA-734j-rghv-fj5v GHSA-7g9v-7vc7-pmrw GHSA-c48q-x6xw-g5h8 GHSA-gr77-83rx-v97c GHSA-m4w2-g4cp-m5hw GHSA-rfcx-6p2f-m3vg --- .../GHSA-3cxc-phxh-65vq.json | 44 +++++++++++++++++++ .../GHSA-3w5w-m35v-rfp7.json | 44 +++++++++++++++++++ .../GHSA-734j-rghv-fj5v.json | 36 +++++++++++++++ .../GHSA-7g9v-7vc7-pmrw.json | 40 +++++++++++++++++ .../GHSA-c48q-x6xw-g5h8.json | 44 +++++++++++++++++++ .../GHSA-gr77-83rx-v97c.json | 44 +++++++++++++++++++ .../GHSA-m4w2-g4cp-m5hw.json | 44 +++++++++++++++++++ .../GHSA-rfcx-6p2f-m3vg.json | 36 +++++++++++++++ 8 files changed, 332 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-3cxc-phxh-65vq/GHSA-3cxc-phxh-65vq.json create mode 100644 advisories/unreviewed/2025/04/GHSA-3w5w-m35v-rfp7/GHSA-3w5w-m35v-rfp7.json create mode 100644 advisories/unreviewed/2025/04/GHSA-734j-rghv-fj5v/GHSA-734j-rghv-fj5v.json create mode 100644 advisories/unreviewed/2025/04/GHSA-7g9v-7vc7-pmrw/GHSA-7g9v-7vc7-pmrw.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c48q-x6xw-g5h8/GHSA-c48q-x6xw-g5h8.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gr77-83rx-v97c/GHSA-gr77-83rx-v97c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-m4w2-g4cp-m5hw/GHSA-m4w2-g4cp-m5hw.json create mode 100644 advisories/unreviewed/2025/04/GHSA-rfcx-6p2f-m3vg/GHSA-rfcx-6p2f-m3vg.json diff --git a/advisories/unreviewed/2025/04/GHSA-3cxc-phxh-65vq/GHSA-3cxc-phxh-65vq.json b/advisories/unreviewed/2025/04/GHSA-3cxc-phxh-65vq/GHSA-3cxc-phxh-65vq.json new file mode 100644 index 00000000000..94ef1690edd --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-3cxc-phxh-65vq/GHSA-3cxc-phxh-65vq.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3cxc-phxh-65vq", + "modified": "2025-04-21T00:30:19Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2025-43964" + ], + "details": "In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43964" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4" + }, + { + "type": "WEB", + "url": "https://www.libraw.org/news/libraw-0-21-4-release" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1284" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-21T00:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-3w5w-m35v-rfp7/GHSA-3w5w-m35v-rfp7.json b/advisories/unreviewed/2025/04/GHSA-3w5w-m35v-rfp7/GHSA-3w5w-m35v-rfp7.json new file mode 100644 index 00000000000..8fb899b1abf --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-3w5w-m35v-rfp7/GHSA-3w5w-m35v-rfp7.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3w5w-m35v-rfp7", + "modified": "2025-04-21T00:30:20Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2025-43963" + ], + "details": "In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43963" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4" + }, + { + "type": "WEB", + "url": "https://www.libraw.org/news/libraw-0-21-4-release" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-21T00:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-734j-rghv-fj5v/GHSA-734j-rghv-fj5v.json b/advisories/unreviewed/2025/04/GHSA-734j-rghv-fj5v/GHSA-734j-rghv-fj5v.json new file mode 100644 index 00000000000..e09ebd96664 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-734j-rghv-fj5v/GHSA-734j-rghv-fj5v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-734j-rghv-fj5v", + "modified": "2025-04-21T00:30:19Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2020-36844" + ], + "details": "The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36844" + }, + { + "type": "WEB", + "url": "https://www.doyler.net/security-not-included/knowbe4-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-20T22:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7g9v-7vc7-pmrw/GHSA-7g9v-7vc7-pmrw.json b/advisories/unreviewed/2025/04/GHSA-7g9v-7vc7-pmrw/GHSA-7g9v-7vc7-pmrw.json new file mode 100644 index 00000000000..01e1ca1b761 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-7g9v-7vc7-pmrw/GHSA-7g9v-7vc7-pmrw.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7g9v-7vc7-pmrw", + "modified": "2025-04-21T00:30:20Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2025-43966" + ], + "details": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43966" + }, + { + "type": "WEB", + "url": "https://github.com/strukturag/libheif/commit/b38555387e4b5dcf036fe45b0c440aca19b7b69c" + }, + { + "type": "WEB", + "url": "https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-21T00:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c48q-x6xw-g5h8/GHSA-c48q-x6xw-g5h8.json b/advisories/unreviewed/2025/04/GHSA-c48q-x6xw-g5h8/GHSA-c48q-x6xw-g5h8.json new file mode 100644 index 00000000000..3ecdcd78a81 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c48q-x6xw-g5h8/GHSA-c48q-x6xw-g5h8.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c48q-x6xw-g5h8", + "modified": "2025-04-21T00:30:20Z", + "published": "2025-04-21T00:30:20Z", + "aliases": [ + "CVE-2025-43967" + ], + "details": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43967" + }, + { + "type": "WEB", + "url": "https://github.com/strukturag/libheif/issues/1455" + }, + { + "type": "WEB", + "url": "https://github.com/strukturag/libheif/commit/6e35af7b0ff9fb6cc952a1539590d160db32f671" + }, + { + "type": "WEB", + "url": "https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-21T00:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gr77-83rx-v97c/GHSA-gr77-83rx-v97c.json b/advisories/unreviewed/2025/04/GHSA-gr77-83rx-v97c/GHSA-gr77-83rx-v97c.json new file mode 100644 index 00000000000..986e50e2314 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gr77-83rx-v97c/GHSA-gr77-83rx-v97c.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gr77-83rx-v97c", + "modified": "2025-04-21T00:30:19Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2025-43962" + ], + "details": "In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43962" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4" + }, + { + "type": "WEB", + "url": "https://www.libraw.org/news/libraw-0-21-4-release" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-21T00:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-m4w2-g4cp-m5hw/GHSA-m4w2-g4cp-m5hw.json b/advisories/unreviewed/2025/04/GHSA-m4w2-g4cp-m5hw/GHSA-m4w2-g4cp-m5hw.json new file mode 100644 index 00000000000..3d4002574e2 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-m4w2-g4cp-m5hw/GHSA-m4w2-g4cp-m5hw.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m4w2-g4cp-m5hw", + "modified": "2025-04-21T00:30:19Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2025-43961" + ], + "details": "In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43961" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2" + }, + { + "type": "WEB", + "url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4" + }, + { + "type": "WEB", + "url": "https://www.libraw.org/news/libraw-0-21-4-release" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-21T00:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-rfcx-6p2f-m3vg/GHSA-rfcx-6p2f-m3vg.json b/advisories/unreviewed/2025/04/GHSA-rfcx-6p2f-m3vg/GHSA-rfcx-6p2f-m3vg.json new file mode 100644 index 00000000000..531b8e213f1 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-rfcx-6p2f-m3vg/GHSA-rfcx-6p2f-m3vg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rfcx-6p2f-m3vg", + "modified": "2025-04-21T00:30:19Z", + "published": "2025-04-21T00:30:19Z", + "aliases": [ + "CVE-2020-36845" + ], + "details": "The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. The response has a SCRIPT element that sets window.location.href to an arbitrary https URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36845" + }, + { + "type": "WEB", + "url": "https://www.doyler.net/security-not-included/knowbe4-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-601" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-20T22:15:29Z" + } +} \ No newline at end of file