Skip to content

Commit 5d71882

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6hjr-v6g4-3fm8 GHSA-9xc6-c2rm-f27p GHSA-pvcv-q3q7-266g
1 parent 1453c67 commit 5d71882

File tree

3 files changed

+281
-2
lines changed

3 files changed

+281
-2
lines changed

‎advisories/github-reviewed/2025/12/GHSA-6hjr-v6g4-3fm8/GHSA-6hjr-v6g4-3fm8.json‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hjr-v6g4-3fm8",
4+
"modified": "2025-12-10T15:47:42Z",
5+
"published": "2025-12-10T15:47:42Z",
6+
"aliases": [
7+
"CVE-2025-66628"
8+
],
9+
"summary": "ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)",
10+
"details": "### Summary\nThe TIM (PSX TIM) image parser in ImageMagick contains a critical integer overflow vulnerability in the `ReadTIMImage` function (`coders/tim.c`). The code reads `width` and `height` (16-bit values) from the file header and calculates `image_size = 2 * width * height` without checking for overflow.\nOn 32-bit systems (or where `size_t` is 32-bit), this calculation can overflow if `width` and `height` are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via `AcquireQuantumMemory` and later operations relying on the dimensions can trigger an out of bounds read.\n### Vulnerable Code\nFile: `coders/tim.c`\n```c\nwidth=ReadBlobLSBShort(image);\nheight=ReadBlobLSBShort(image);\nimage_size=2*width*height; // Line 234 - NO OVERFLOW CHECK!\n```\n\n### Impact\nThis vulnerability can lead to Arbitrary Memory Disclosure due to an out of bounds read on 32-bit systems.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "NuGet",
21+
"name": "Magick.NET-Q16-AnyCPU"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "14.10.0"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "NuGet",
40+
"name": "Magick.NET-Q16-HDRI-AnyCPU"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "14.10.0"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "NuGet",
59+
"name": "Magick.NET-Q16-HDRI-x86"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "14.10.0"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "NuGet",
78+
"name": "Magick.NET-Q16-x86"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "0"
86+
},
87+
{
88+
"fixed": "14.10.0"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "NuGet",
97+
"name": "Magick.NET-Q8-AnyCPU"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "0"
105+
},
106+
{
107+
"fixed": "14.10.0"
108+
}
109+
]
110+
}
111+
]
112+
},
113+
{
114+
"package": {
115+
"ecosystem": "NuGet",
116+
"name": "Magick.NET-Q8-x86"
117+
},
118+
"ranges": [
119+
{
120+
"type": "ECOSYSTEM",
121+
"events": [
122+
{
123+
"introduced": "0"
124+
},
125+
{
126+
"fixed": "14.10.0"
127+
}
128+
]
129+
}
130+
]
131+
}
132+
],
133+
"references": [
134+
{
135+
"type": "WEB",
136+
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
137+
},
138+
{
139+
"type": "WEB",
140+
"url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
141+
},
142+
{
143+
"type": "PACKAGE",
144+
"url": "https://github.com/ImageMagick/ImageMagick"
145+
}
146+
],
147+
"database_specific": {
148+
"cwe_ids": [
149+
"CWE-125"
150+
],
151+
"severity": "HIGH",
152+
"github_reviewed": true,
153+
"github_reviewed_at": "2025-12-10T15:47:42Z",
154+
"nvd_published_at": null
155+
}
156+
}

‎advisories/github-reviewed/2025/12/GHSA-9xc6-c2rm-f27p/GHSA-9xc6-c2rm-f27p.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9xc6-c2rm-f27p",
4+
"modified": "2025-12-10T15:47:12Z",
5+
"published": "2025-12-10T15:47:12Z",
6+
"aliases": [
7+
"CVE-2025-66474"
8+
],
9+
"summary": "XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection",
10+
"details": "### Impact\nAny user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. To demonstrate, the content `{{html}}{{/html {{/html}}}}` can be inserted into any field of the user profile that supports wiki syntax like the \"About\" field. If this leads to the display of raw HTML, the instance is vulnerable.\n\n### Patches\nThis problem has been patched by extending the escaping introduced by [XRENDERING-693](https://jira.xwiki.org/browse/XRENDERING-693) to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3 and 17.6.0RC1. A [similar fix](https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11) has been applied in `org.xwiki.platform:xwiki-platform-oldcore` as an extra safety net, see [XWIKI-23378](https://jira.xwiki.org/browse/XWIKI-23378). At this point, we're not aware that this extra safety net would be required for security.\n\nThe patch also fixes the injection of opening HTML macro syntaxes, e.g., with `{{html}}{{html{{/html}}}}` which disrupts the rendering of the user profile but for which we haven't found any further security impact apart from the disruption of the UI.\n\n### Workarounds\nWe're not aware of any workarounds except for upgrading the affected module to a version with a fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.xwiki.rendering:xwiki-rendering-xml"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "16.10.10"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.xwiki.rendering:xwiki-rendering-xml"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "17.0.0-rc-1"
48+
},
49+
{
50+
"fixed": "17.4.3"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.xwiki.rendering:xwiki-rendering-xml"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "17.5.0-rc-1"
67+
},
68+
{
69+
"fixed": "17.6.0-rc-1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49"
88+
},
89+
{
90+
"type": "PACKAGE",
91+
"url": "https://github.com/xwiki/xwiki-rendering"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://jira.xwiki.org/browse/XRENDERING-693"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://jira.xwiki.org/browse/XRENDERING-792"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://jira.xwiki.org/browse/XRENDERING-793"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://jira.xwiki.org/browse/XWIKI-23378"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-95"
113+
],
114+
"severity": "HIGH",
115+
"github_reviewed": true,
116+
"github_reviewed_at": "2025-12-10T15:47:12Z",
117+
"nvd_published_at": null
118+
}
119+
}

‎advisories/github-reviewed/2025/12/GHSA-pvcv-q3q7-266g/GHSA-pvcv-q3q7-266g.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pvcv-q3q7-266g",
4-
"modified": "2025-12-09T19:16:56Z",
4+
"modified": "2025-12-10T15:47:03Z",
55
"published": "2025-12-09T17:19:10Z",
66
"aliases": [
77
"CVE-2025-67507"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-pvcv-q3q7-266g"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67507"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/filamentphp/filament/commit/87ff60ad9b6e16d4e14ee36a220b8917dd7b0815"
@@ -57,6 +61,6 @@
5761
"severity": "HIGH",
5862
"github_reviewed": true,
5963
"github_reviewed_at": "2025-12-09T17:19:10Z",
60-
"nvd_published_at": null
64+
"nvd_published_at": "2025-12-10T01:15:52Z"
6165
}
6266
}

0 commit comments

Comments
 (0)