Even Rouault

37 exploits Active since Nov 2016
CVE-2026-8212 WRITEUP MEDIUM WRITEUP
OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow
A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.
CVSS 5.3
CVE-2026-8213 WRITEUP MEDIUM WRITEUP
OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow
A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 3.13.0RC1 can resolve this issue. The identifier of the patch is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. It is suggested to upgrade the affected component.
CVSS 5.3
CVE-2026-8084 WRITEUP LOW WRITEUP
OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.
CVSS 3.3
CVE-2026-8086 WRITEUP MEDIUM WRITEUP
OSGeo gdal SWapi.c SWnentries heap-based overflow
A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.
CVSS 5.3
CVE-2026-8087 WRITEUP MEDIUM WRITEUP
OSGeo gdal GDapi.c GDnentries heap-based overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
CVSS 5.3
CVE-2026-8088 WRITEUP LOW WRITEUP
OSGeo gdal GDapi.c GDfieldinfo out-of-bounds
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.
CVSS 3.3
CVE-2016-10504 WRITEUP MEDIUM WRITEUP
OpenJPEG < 2.2.0 - Heap-Based Buffer Overflow in opj_mqc_byteout
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
CVSS 6.5
CVE-2019-25050 WRITEUP HIGH WRITEUP
GDAL 2.4.2-3.0.4 - Stack-based Buffer Overflow in netCDF Dataset Handling
netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).
CVSS 7.8
CVE-2026-6192 WRITEUP LOW WRITEUP
uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
CVSS 3.3
CVE-2022-0908 WRITEUP HIGH WRITEUP
libtiff < 4.3.0 - Denial of Service via memcpy() in TIFFFetchNormalTag
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
CVSS 7.7
CVE-2022-1354 WRITEUP MEDIUM WRITEUP
libtiff < 4.4.0 - Denial of Service via Crafted TIFF File in TIFFReadRawDataStriped
A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.
CVSS 5.5
CVE-2022-1622 WRITEUP MEDIUM WRITEUP
libtiff - Out-of-bounds Read in LZWDecode
LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
CVSS 5.5
CVE-2022-1623 WRITEUP MEDIUM WRITEUP
libtiff - Out-of-bounds Read in LZWDecode
LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
CVSS 5.5
CVE-2022-3970 WRITEUP MEDIUM WRITEUP
libtiff < 4.5.0 - Integer Overflow in TIFFReadRGBATileExt
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.
CVSS 6.3
CVE-2016-9533 WRITEUP CRITICAL WRITEUP
libtiff - Heap-Based Buffer Overflow in PixarLog horizontalDifference
tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow."
CVSS 9.8
CVE-2016-9534 WRITEUP CRITICAL WRITEUP
libtiff - Heap-Based Buffer Overflow in TIFFFlushData1 Error Handling
tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."
CVSS 9.8
CVE-2016-9535 WRITEUP CRITICAL WRITEUP
libtiff - Heap-Based Buffer Overflow in Predictor Function
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
CVSS 9.8
CVE-2016-9536 WRITEUP CRITICAL WRITEUP
libtiff 4.0.6 - Heap-Based Buffer Overflow in t2p_process_jpeg_strip
tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."
CVSS 9.8
CVE-2016-9537 WRITEUP CRITICAL WRITEUP
libtiff 4.0.6 - Out-of-Bounds Write in tiffcrop
tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.
CVSS 9.8
CVE-2016-9538 WRITEUP CRITICAL WRITEUP
libtiff - Integer Overflow in readContigStripsIntoBuffer
tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.
CVSS 9.8
CVE-2016-9539 WRITEUP CRITICAL WRITEUP
libtiff 4.0.6 - Out-of-Bounds Read in readContigTilesIntoBuffer
tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.
CVSS 9.8
CVE-2016-9540 WRITEUP CRITICAL WRITEUP
libtiff 4.0.6 - Heap-Based Buffer Overflow in tiffcp
tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."
CVSS 9.8
CVE-2017-12982 WRITEUP MEDIUM WRITEUP
OpenJPEG < 2.3.0 - Denial of Service via Zero biBitCount BMP Header
The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.
CVSS 5.5
CVE-2017-14039 WRITEUP HIGH WRITEUP
OpenJPEG < 2.3.0 - Heap-Based Buffer Overflow in opj_t2_encode_packet
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
CVSS 8.8
CVE-2017-14040 WRITEUP HIGH WRITEUP
OpenJPEG 2.2.0 - Out-of-bounds Write in tgatoimage Function
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
CVSS 8.8