D7Ead

The ` nx snmp utility object id get` function in the NetX Duo SNMP addon fails to validate the claimed OID data length against the actual buffer size when Basic Encoding Rules (BER) multibyte length encoding is used. A remote attacker can send a crafted SNMP packet with a multibyte OID length that exceeds the available buffer, causing the parser to perform an out-of-bounds read into adjacent heap memory. These bytes are then decoded as OID component values and written into the agent's internal OID string buffer, leading to state corruption. On systems with memory protection, this can crash the SNMP agent thread and cause a denial of service, while on bare metal embedded systems without memory protection, the read may silently corrupt the internal state with heap data.

The default `blockUnsafeOperationsPlugin` compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced push arguments, such as abbreviated forms of `--receive-pack` or `--exec`, to bypass the `detectVulnerableFlags` function. Consequently, Git may invoke an attacker-selected command when these arguments are passed to a local or file remote, or an attacker-influenced receive-pack target.

توجد مشكلة في تقليص 정수 (integer truncation) في الدالة `license check stream length()`. يمكن لخادم RDP خبيث استغلال ذلك عن طريق إرسال SERVER LICENSE REQUEST مصمم خصيصاً يحتوي على قيمة `scopeCount` كبيرة. يؤدي هذا إلى تجاوز فحوصات الطول وتسبب في تجاوز سعة مخزن heap المؤقت على العملاء الذين يعملون بنظام 32 بت، مما يؤدي إلى عمليات كتابة خارج الحدود قد تؤدي إلى حجب الخدمة أو تنفيذ رموز عن بُعد.