Anibal Sacco

The issue is related to a buffer overflow in the RTSP Packet Handler, which can be triggered by a long string in the URI in an RTSP SETUP request, such as "/rtsp/setup". This can cause a denial of service, resulting in a device crash, and potentially allow the execution of arbitrary code.

The issue is related to an integer signedness error in Apple Type Services (ATS), which can be exploited by remote attackers to execute arbitrary code. This can be achieved by using a crafted embedded Compact Font Format (CFF) font in a document.

The issue is related to the ippReadIO function in cups/ipp.c, which does not properly initialize memory for IPP request packets. This allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and daemon crash, via a scheduler request with two consecutive IPP TAG UNSUPPORTED tags.

The issue is related to insufficient input validation in the VBoxDrvNtDeviceControl function in VBoxDrv.sys. This function uses the METHOD NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object. As a result, local users can gain privileges by opening the .VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

The issue allows local users to cause a denial of service, resulting in a system crash. This is achieved by providing an invalid pointer to the ` CLIENT ID` structure in a call to the `NtOpenProcess` function, which is hooked in the System Service Descriptor Table (SSDT).

The issue arises from improper validation of certain parameters to hooked System Service Descriptor Table (SSDT) functions. This can be exploited by local users to cause a denial of service, resulting in a system crash. The exploitation vectors include a crafted `OBJECT ATTRIBUTES` structure in a call to the `NtDeleteFile` function, leading to improper validation of a `ZwQueryObject` result, as well as unspecified calls to the `NtCreateFile` and `NtSetThreadContext` functions.

The issue allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file. This is related to the MP4 demuxer (mp4.c) in VLC media player when used in Miro Player.

The issue is related to an array index error in the libmpdemux/demux mov.c file, which could potentially allow remote attackers to execute arbitrary code. This is possible through a crafted QuickTime MOV file that contains a specifically designed stsc atom tag.