CVE-2021-26825 – An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.

CVE-2021-26826 – A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.

CVE-2022-38529 – tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.

News

Google Is Not Deleting Old YouTube Videos

May 22, 2023

Read Time:16 Second

Google has backtracked on its plan to delete inactive YouTube videos—at least for now. Of course, it could change its mind anytime it wants.

It would be nice if this would get people to think about the vulnerabilities inherent in letting a for-profit monopoly decide what of human creativity is worth saving.

Advisories

USN-5900-2: tar vulnerability

May 22, 2023

Read Time:13 Second

USN-5900-1 fixed vulnerabilities in tar. This update fixes it to Ubuntu 23.04.

Original advisory details:

It was discovered that tar incorrectly handled certain files.
An attacker could possibly use this issue to expose sensitive information
or cause a crash.

Advisories