Alan Coopersmith

تسمح مشكلة في منطق فك ضغط رسائل الشبكة المضغوطة بواسطة zlib لمهاجم بعيد غير مصادق عليه بقراءة ذاكرة الكومة غير المُهيأة. من خلال إرسال حزم بيانات مصممة خصيصًا بشكل خاطئ وتحتوي على حقول طول غير متطابقة، يمكن للمهاجم أن يجعل الخادم يخصص مخزنًا مؤقتًا للذاكرة أكبر من اللازم ويعيد أجزاء من ذاكرة الكومة الخاصة به إلى العميل. قد تحتوي هذه الذاكرة على معلومات حساسة مثل كلمات المرور ومفاتيح واجهة برمجة التطبيقات (API) ورموز الجلسات وغيرها من الأسرار. يُقدَّر أن حوالي 87,000 خادم MongoDB معرضة للإنترنت وقد تكون عرضة للخطر، حيث تحتوي 42% من البيئات السحابية على مثيل واحد على الأقل معرض للخطر. وقد تم الإبلاغ عن حالات استغلال فعلية، بما في ذلك ادعاءات بوقوع اختراق في شركة Ubisoft حيث يُزعم أن الثغرة استُخدمت للوصول إلى المستودعات الداخلية وسرقة شفرة المصدر وبيانات المستخدمين.

ترتبط هذه الثغرة الأمنية بقراءة مفرطة للمخزن المؤقت (buffer over-read) في عملية التحقق من صحة الترميز GB18030 في PostgreSQL. تسمح هذه المشكلة لمزود إدخال قاعدة البيانات بالتسبب في انقطاع مؤقت للخدمة على الأنظمة الأساسية التي قد تؤدي فيها القراءة المفرطة لبايت واحد إلى إنهاء العملية. تؤثر هذه الثغرة الأمنية على خادم قاعدة البيانات وكذلك على libpq. يمكن للمهاجم استغلال هذه المشكلة لإحداث تعطل في PostgreSQL، مما يؤدي إلى رفض الخدمة.

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.82.1 Description: The issue is related to an off-by-one error and resultant buffer overflow in the `gio/gsocks4aproxy.c` component of GNOME GLib. This occurs because `SOCKS4 CONN MSG LEN` is not sufficient for a trailing `0` character. The vulnerability is associated with uncontrolled copying of input data, which could allow a remote attacker to cause a denial of service. Despite being marked as critical, exploitation of this issue in real-world scenarios is considered highly unlikely. Recommendations: For GNOME GLib versions prior to 2.82.1, update to version 2.82.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `gio/gsocks4aproxy.c` component until a patch is applied. Avoid using the `SOCKS4 CONN MSG LEN` variable in affected API endpoints until the issue is resolved.

The issue is related to regular expressions used in tarfile.TarFile header parsing, which can cause excessive backtracking and are vulnerable to ReDoS via specifically-crafted tar archives. This can lead to a denial of service. The vulnerability is associated with incorrect syntax analysis of the file header.

The issue is related to hardware logic with insecure de-synchronization in Intel DSA and Intel IAA, which may allow an authorized user to potentially enable escalation of privilege or denial of service via local access.

A heap-based buffer over-read issue was found in the X.org server's `ProcAppleDRICreatePixmap()` function. This occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, especially when triggered by a client with different endianness. An attacker could exploit this to cause the X server to read heap memory values and transmit them back to the client until encountering an unmapped page, resulting in a crash. Although the attacker cannot control the specific memory copied into the replies, small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. This could allow an attacker to access confidential data, compromise their integrity, and cause a denial of service.

The issue allows an attacker to cause a denial of service, specifically memory consumption, via a window resize escape sequence. This is related to a historical issue.

The issue is related to a use-after-free vulnerability in the `xmlUnlinkNode` function, located in `tree.c`, which can occur after a certain memory allocation fails. This could potentially allow a remote attacker to cause a denial of service. The vendor has stated that they do not consider this issue critical enough to warrant a fix because an attacker typically cannot control when memory allocations fail.

A security flaw was found in libX11 due to functions in src/InitExt.c not checking if the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to. This can lead to memory corruption, potentially causing the client to crash, if a malicious server or proxy-in-the-middle provides out-of-bounds values. The issue is related to buffer overflows in InitExt.c.

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the `PATH` environment variable. This could potentially allow an attacker to execute arbitrary code with elevated privileges.

The issue is related to the `cr parser parse any core` function in the `cr-parser.c` component of the libcroco library, which is used for working with cascading style sheets (css2). It is associated with uncontrolled recursion. Exploitation of this issue may allow a remote attacker to compromise data integrity and cause a denial of service.

The issue is related to an integer overflow in the `ProcDbeGetVisualInfo` function, which could allow a malicious X client to cause the X server to crash or possibly execute arbitrary code.

The issue is related to the `bdfReadCharacters` function in `bitmap/bdfread.c`, which does not properly perform type conversion for metrics values. This allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.

The issue is related to a stack-based buffer overflow in the `bdfReadCharacters` function, which can be triggered by a long string in a character name in a BDF font file. This can cause a denial of service (crash) or possibly allow remote attackers to execute arbitrary code. Multiple vulnerabilities in the libXfont package can lead to violations of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.