References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Known Affected Software Configurations Switch to CPE 2.2

Change History

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0933

Talos CWE-191

Talos AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-191

CWE-787

NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NIST (AV:N/AC:M/Au:N/C:P/I:P/A:P)

NIST CWE-191

OR
     *cpe:2.3:a:kakadusoftware:kakadu_software:7.10.2:*:*:*:*:*:*:*

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0933 No Types Assigned

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0933 Third Party Advisory

Victim must voluntarily interact with attack mechanism

A freed memory access vulnerability exists in the SVG Marker Element feature of Apple Safari's WebKit version 13.0.2. A specially crafted HTML web page can cause a use after free, resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerability, a specifically crafted HTML web page needs to be opened in the browser.

An exploitable heap underflow vulnerability exists in the derive_taps_and_gains function in kdu_v7ar.dll of Kakadu Software SDK 7.10.2. A specially crafted jp2 file can cause a heap overflow, which can result in remote code execution. An attacker could provide a malformed file to the victim to trigger this vulnerability.