# CVEs published 2018-12-22

14 CVEs were published on December 22, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-20367](https://cve.now/CVE-2018-20367.md): The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8\_181212 has stored XSS via the consultContent parameter, (no CVSS)
- [CVE-2018-20363](https://cve.now/CVE-2018-20363.md): LibRaw::raw2image in libraw\_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (no CVSS)
- [CVE-2018-20364](https://cve.now/CVE-2018-20364.md): LibRaw::copy\_bayer in libraw\_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (no CVSS)
- [CVE-2018-20365](https://cve.now/CVE-2018-20365.md): LibRaw::raw2image() in libraw\_cxx.cpp has a heap-based buffer overflow. (no CVSS)
- [CVE-2018-19863](https://cve.now/CVE-2018-19863.md): An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. (no CVSS)
- [CVE-2018-20357](https://cve.now/CVE-2018-20357.md): A NULL pointer dereference was discovered in sbr\_process\_channel of libfaad/sbr\_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS)
- [CVE-2018-20358](https://cve.now/CVE-2018-20358.md): An invalid memory address dereference was discovered in the lt\_prediction function of libfaad/lt\_predict.c in Freeware Advanced Audio Decode (no CVSS)
- [CVE-2018-20359](https://cve.now/CVE-2018-20359.md): An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr\_dec.c in Freeware Advanced Audio (no CVSS)
- [CVE-2018-20360](https://cve.now/CVE-2018-20360.md): An invalid memory address dereference was discovered in the sbr\_process\_channel function of libfaad/sbr\_dec.c in Freeware Advanced Audio Dec (no CVSS)
- [CVE-2018-20361](https://cve.now/CVE-2018-20361.md): An invalid memory address dereference was discovered in the hf\_assembly function of libfaad/sbr\_hfadj.c in Freeware Advanced Audio Decoder 2 (no CVSS)
- [CVE-2018-20362](https://cve.now/CVE-2018-20362.md): A NULL pointer dereference was discovered in ifilter\_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS)
- [CVE-2018-20348](https://cve.now/CVE-2018-20348.md): libpff\_item\_tree\_create\_node in libpff\_item\_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (inf (no CVSS)
- [CVE-2018-20349](https://cve.now/CVE-2018-20349.md): The igraph\_i\_strdiff function in igraph\_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a deni (no CVSS)
- [CVE-2018-20351](https://cve.now/CVE-2018-20351.md): The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.