Vulnerabilities (CVE)

Filtered by vendor Swi-prolog Subscribe
Filtered by product Swi-prolog
Total 4 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-17524 1 Swi-prolog 1 Swi-prolog 2024-02-04 6.8 MEDIUM 8.8 HIGH
library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
CVE-2012-6089 1 Swi-prolog 1 Swi-prolog 2024-02-04 7.5 HIGH N/A
Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
CVE-2012-6090 1 Swi-prolog 1 Swi-prolog 2024-02-04 7.5 HIGH N/A
Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
CVE-2011-2896 3 Apple, Gimp, Swi-prolog 3 Cups, Gimp, Swi-prolog 2024-02-04 5.1 MEDIUM N/A
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.