Уязвимость мультимедийной библиотеки Ffmpeg, связанная с чтением данных за границами буфера в памяти, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Уязвимость функции mov_read_trak библиотеки libavformat мультимедийной библиотеки FFmpeg, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции ff_aac_search_for_tns компонента libavcodec/aacenc_tns.c мультимедийной библиотеки FFmpeg, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации, нарушить её целостность, а также вызвать отказ в обслуживании

ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.

Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman

A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The patch is identified as 43be8d07281caca2e88bfd8ee2333633e1fb1a13. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Уязвимость компилятора инструмента для html-шаблонизации jinja, связанная с непринятием мер по нейтрализации специальных элементов в механизме создания шаблонов, позволяющая нарушителю вызвать отказ в обслуживании

Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

Уязвимость функции SetQuantumFormat() консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость консольного графического редактора ImageMagick, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).

Уязвимость программной платформы для веб-приложений Django, связанная с недостаточной проверкой входных данных, позволяющая нарушителю вызвать отказ в обслуживании

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

Django vulnerable to Allocation of Resources Without Limits or Throttling

distro-license-check: distribution branch 'p11' is not valid

Неверный путь к базе данных innodb в конфиге