2026-10-13 归档

今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。

漏洞预警2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted image...

CVE-2026-109262

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fail

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during enco...

CVE-2026-109261

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attacke...

CVE-2026-109260

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release a

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a craft...

CVE-2026-109259

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers ca...

CVE-2026-109258

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-12 发布INFO

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attacker...

CVE-2026-109257

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane

历史摘要 · 未重新核验 · NVD

#cve #cwe-415

漏洞预警2026-10-12 发布INFO

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard...

CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-12 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 3...

CVE-2026-109255

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-12 发布INFO

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_threa...

CVE-2026-109254

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-12 发布INFO

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Mali...

CVE-2026-109253

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which ch

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-12 发布INFO

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC...

CVE-2026-109252

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-12 发布INFO

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() w...

CVE-2026-109251

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-10-12 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#1...

CVE-2026-109250

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-129

漏洞预警2026-10-12 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remainin...

CVE-2026-109249

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-12 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRI...

CVE-2026-109248

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_t

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-12 发布INFO

FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-s...

CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinp

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-12 发布INFO

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without ...

CVE-2026-109245

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfr

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-12 发布INFO

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users...

CVE-2026-109244

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypte

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-12 发布INFO

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner...

CVE-2026-109243

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to re

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-10-12 发布INFO

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A...

CVE-2026-109242

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because

历史摘要 · 未重新核验 · NVD

#cve #cwe-908