Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-12598OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modulPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12599OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when readiPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12600OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12601OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecsPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12602OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption) issue, as demonstrated by the 10-opencPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12603OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12604OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reaPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12605OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when rePyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12606OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when rePyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2015-3171sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive PyPI · sosreport · fixed in 3.3
- CVE-2017-1000001FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.PyPI · fedmsg · fixed in 0.18.2
- CVE-2017-1000007txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information diPyPI · txaws · fixed in 0.4.0
- CVE-2016-8638A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log PyPI · ipsilon · fixed in 2.0.2, 1.2.1, 1.1.2 and more
- CVE-2017-2810An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4.PyPI · tablib · fixed in 0.11.5
- CVE-2015-3220The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).PyPI · tlslite · fixed in 0.4.9
- CVE-2014-3498The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.PyPI · ansible · fixed in 1.6.6
- CVE-2015-6240The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attPyPI · ansible · fixed in 1.9.2
- CVE-2017-9462In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbiPyPI · mercurial · fixed in 4.1.3
- CVE-2017-9239An issue was discovered in Exiv2 0.26.PyPI · exiv2
- CVE-2017-9111In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or PyPI · openexr · fixed in 2.2.1
- CVE-2017-9112In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.PyPI · openexr · fixed in 2.2.1
- CVE-2017-8359Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in PyPI · grpcio · fixed in 1.3.0
- CVE-2017-8342Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authenticatiPyPI · radicale · fixed in 1.1.2, 2.0.0rc2
- CVE-2017-8109The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissPyPI · salt · fixed in 2016.11.4
- CVE-2016-6902lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.PyPI · limited-shell
- CVE-2016-6903lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.PyPI · limited-shell
- CVE-2017-3590Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python).PyPI · mysql-connector-python
- CVE-2016-3076Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of serviPyPI · pillow · fixed in 3.1.2
- CVE-2016-3691Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.PyPI · kallithea · fixed in 0.3.2
- CVE-2016-6519Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to injePyPI · manila-ui · fixed in 2.5.1