Osidb Bzimport

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** The PlayStation TIM loader, which handles PlayStation image files, contains an integer overflow when calculating the size of the Color Look-Up Table (CLUT). This occurs during the multiplication of the `num colors` and `num cluts` variables, both of which are 16-bit unsigned short integers. A specially crafted image file can trigger this overflow, leading to undefined behavior and causing the plug-in to abort, which results in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw in the `org.keycloak.broker.oidc` package causes the OIDC broker to incorrectly synchronize the `email verified` claim. When an OIDC identity provider is configured with `trustEmail=true` and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but takes the `email verified` status solely from the `id token`. Because there is no validation to ensure the `email verified` claim in the `id token` corresponds to the email address from the userinfo endpoint, a `email verified=true` claim from the `id token` can be applied to a different email address returned by the userinfo endpoint. This occurs if an attacker controls or compromises the upstream OIDC provider. This can lead to arbitrary email addresses being marked as verified in the database, bypassing email-based security controls, or potential account takeover if the application relies on the `email verified` flag for account linking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, set `trustEmail` to false for OIDC identity providers or disable the userinfo endpoint.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the `ClientResource` component of the admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator with limited control over specific clients to attach or remove hidden client scopes they are not authorized to manage. This could enable an attacker to inject unauthorized data or permissions into security tokens issued to end-users, potentially leading other applications to grant higher access levels than intended. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPLIP (affected versions not specified) **Description** An integer overflow exists in the `hpcups` processing path when handling specially crafted print data. This flaw may allow a remote attacker to escalate privileges or achieve arbitrary code execution. An integer overflow occurs when an arithmetic operation results in a value that exceeds the storage capacity of the integer type used to hold it, potentially leading to memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An issue in the administrative interface occurs when Fine-Grained Admin Permissions (FGAP v2) are enabled. An administrator with permission to view a specific role can access a list of all groups assigned to that role because the system fails to verify if the administrator has the necessary permissions to view those specific groups. This allows restricted administrators to discover hidden groups and access metadata, including internal names and custom settings, which may contain sensitive deployment information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A heap buffer overflow exists in the Paint Shop Pro (PSP) file format parser. The issue occurs when the software incorrectly calculates buffer sizes while processing low bit-depth images, which leads to the overwriting of adjacent memory. A remote attacker can exploit this by tricking a user into opening a specially crafted PSP image file, potentially resulting in arbitrary code execution or a denial of service (DoS). **Recommendations** Update GIMP to the patched build provided by your distribution.

**Name of the Vulnerable Software and Affected Versions** Feast Feature Server (affected versions not specified) **Description** An unauthenticated remote attacker can write arbitrary JSON files to the server filesystem via the `/save-document` endpoint. The issue stems from improper input validation that allows a path restriction bypass, enabling the attacker to escape the intended save directory and overwrite critical application configurations or startup scripts. This could result in unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution if the written files are subsequently executed or loaded by the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/save-document` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GLib (affected versions not specified) **Description** A flaw exists in the D-Bus client-side implementation of the DBUS COOKIE SHA1 SASL authentication mechanism. The system fails to validate the `cookie context` parameter received from the server. A malicious D-Bus server can provide a `cookie context` containing path traversal sequences—a technique used to access files and directories outside the intended folder—forcing the client to read arbitrary files. This allows the server to exfiltrate sensitive data by comparing guessed file contents against a generated hash. The issue involves the `keyring lookup entry()` and `mechanism client data receive()` functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the Identity Provider (IdP) mapper component, which manages the mapping of user information from external services to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this by creating a "Hardcoded Role" mapper to assign high-level administrative roles, such as `realm-admin`, to themselves or other users. This allows a restricted administrator to bypass security checks and obtain full control over the entire realm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GLib (affected versions not specified) **Description** A buffer over-read can occur in the `g regex replace()` function when the `G REGEX RAW` compile flag is used alongside case-change replacement escapes. This happens because the `string append()` function processes matched substrings using UTF-8 functions, such as `g utf8 next char()`, which assume valid UTF-8 input even when the string is treated as raw bytes. This issue can lead to a minor information disclosure of 1-5 bytes or a denial of service if the buffer over-read crosses a page boundary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** glib2 (affected versions not specified) mingw-glib2 (affected versions not specified) **Description** An off-by-one error exists in the `g key file get locale string list()` function within the `gkeyfile.c` file. This issue occurs when the software loads a key file containing an empty value, leading to a 1-byte out-of-bounds read. An attacker can trigger this by providing a crafted .ini-style key file for the application to parse. If the out-of-bounds access crosses a page boundary, it can cause the process to crash, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL pointer dereference or refcount corruption exists in the iommu/vt-d component. When `dev pasid` is not found in the `dev pasids` list and remains NULL, teardown operations are executed unconditionally. If the domain was never attached to the IOMMU, the `info` variable will be NULL, leading to an immediate dereference when checking `info->refcnt`. Additionally, decrementing the refcount without removing a valid PASID can unbalance the count, potentially causing the refcount to drop to 0 prematurely and resulting in a use-after-free for other active devices sharing the domain. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw in `org.keycloak.authorization` allows an authenticated user who possesses a User-Managed Access (UMA) permission ticket for a single resource to bypass per-resource access control. By using a specific permission request prefix, the user can gain unauthorized access to all resources of the same type within the same resource server. This occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with `ownerManagedAccess` enabled that lack an explicit protecting policy. This can lead to unauthorized information disclosure or modification of resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A slab out-of-bounds write exists in the `kl5kusb105` USB serial driver. The function `klsi 105 prepare write buffer()` incorrectly handles the bulk-out buffer by storing a two-byte length header at the start and then attempting to copy the full buffer size from the write fifo starting at an offset. This results in writing `KLSI HDR LEN` bytes beyond the end of the allocated buffer when the fifo contains enough data. This issue is triggered when writing `bulk out size` or more bytes to the tty. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apicurio Registry (affected versions not specified) **Description** A flaw exists in the `DocumentBuilderAccessor` where DOCTYPE declarations are not disabled and `FEATURE SECURE PROCESSING` is not enabled. Although external DTD and schema access are blocked, an attacker with artifact-write permissions can upload XML documents containing internal entity-expansion payloads, such as the billion-laughs variant. This can lead to CPU and heap exhaustion, though the JAXP default limit of 64,000 entity expansions provides partial mitigation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw in the `libceph` component allows a remote attacker to cause a system crash and a Denial of Service (DoS) by sending a specially crafted `CEPH MSG OSD MAP` message. The issue occurs in the `crush decode()` function when two internal fields, `alg` and `b->alg`, contain differing bucket algorithm values. Because `alg` is used for memory allocation while `b->alg` is used for subsequent processing and memory deallocation, this discrepancy leads to an out-of-bounds memory access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw in the `nvmet-tcp` component occurs because the `nvmet tcp build pdu iovec()` function does not propagate errors to its callers when detecting out-of-bounds PDU (Protocol Data Unit) lengths or offsets. Because the function returns void, callers like `nvmet tcp handle h2c data pdu()` remain unaware of fatal errors, leaving the `cmd->recv msg.msg iter` uninitialized. This can result in the socket receiving loop attempting to read incoming network data into the uninitialized iterator, potentially leading to memory corruption, denial of service, or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** A CPU exhaustion Denial of Service (DoS) occurs due to superlinear (approximately O(n²)) behavior in the `parse link text()` function. When processing Markdown containing numerous consecutive [ characters, the function repeatedly scans the input using a regex search within a loop, re-scanning large portions of the remaining string in each iteration. This quadratic-time behavior allows an attacker to trigger excessive CPU usage using a small payload. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** OpenSSH (affected versions not specified) **Description** A double free flaw exists in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. A malicious SSH server can exploit this to cause client-side process termination, leading to a Denial of Service (DoS). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSH (affected versions not specified) **Description** A flaw in OpenSSH allows a local unprivileged attacker on a Linux client host to hijack client-side X11 forwarding connections. This occurs when X11 forwarding is enabled and a local UNIX-domain X socket is used, allowing the attacker to pre-bind the preferred abstract X socket name. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may enable manipulation of the forwarded session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.