Bas Alberts

يسمح ثغرة في Emacs TRAMP لمهاجم محلي بتنفيذ تعليمات برمجية عشوائية من خلال معالجة أسماء ملفات مصممة بشكل خبيث. تنشأ هذه المشكلة لأن TRAMP يقوم بربط معلمات تسجيل الدخول دون تنقية مناسبة قبل تمريرها إلى شل محلي.

Name of the Vulnerable Software and Affected Versions: png-img versions prior to 3.1.0 Description: The issue is caused by an integer overflow in the PngImg::InitStorage () function, leading to under-allocation of heap memory. This results in a heap-based buffer overflow when a crafted PNG file is loaded. Recommendations: For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the PngImg::InitStorage () function until a patch is available.

The SSH protocol dissector in nDPI has multiple KEXINIT integer overflows, resulting in a controlled remote heap overflow in `concat hash string` in `ssh.c`. This issue can be exploited to achieve full Remote Code Execution against any network inspection stack linked against nDPI that uses it for network traffic analysis.

The issue allows a network-positioned attacker to exploit an out-of-bounds read in `concat hash string` in `ssh.c` by sending malformed SSH protocol messages on a network segment monitored by nDPI's library.