Daniel Birtwhistle

يمكن لخادم HTTP/2 خبيث أو مخترق أن يتسبب في تعطل التطبيق من خلال حجب SETTINGS ACK وإرسال RST STREAM على تدفق مكتمل لزرع مؤشر فارغ (null pointer). بعد ذلك، يؤدي إرسال PUSH PROMISE لهذا التدفق إلى إلغاء مرجع المؤشر الفارغ (null pointer dereference) داخل فئة `QNetworkAccessManager`. يحدث إلغاء مرجع المؤشر الفارغ عندما يحاول البرنامج القراءة من أو الكتابة في عنوان ذاكرة يكون NULL، مما يؤدي عادةً إلى تعطل التطبيق فوراً.

توجد مشكلة use-after-free في دعم عميل HTTP/2 لوحدة Qt Network ضمن QNetworkAccessManager، مما يسمح لخادم HTTP/2 خبيث أو مخترق بالتسبب في تعطل التطبيق العميل، مما يؤثر على التوافر. يحدث use-after-free عندما يستمر البرنامج في استخدام مؤشر بعد تحريره، مما قد يؤدي إلى تعطل النظام أو تنفيذ رمز عشوائي.

Forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-reference accumulator for every resolved ID. This occurs within the `CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()` function and the corresponding implementation in `MapDeserializer`. If a document creates N unresolved object-ID references in an identity-enabled collection or map and subsequently defines those IDs in reverse order, the system performs quadratic CPU work during deserialization. This allows a shallow document to cause excessive CPU consumption through a high number of identity comparisons.

The ` findDeserializer()` function in `TypeDeserializerBase` caches resolved deserializers using the raw type ID provided by the user. In configurations using name-based polymorphism with a fallback, such as `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, each unique unrecognized type ID is stored as a separate key in the ` deserializers` map, even though they all resolve to the same fallback deserializer. Because this map lacks a configurable bound and persists for the lifetime of the type deserializer, an attacker can cause continuous memory retention by supplying numerous unique unknown type IDs. This issue occurs when an application enables name-based polymorphism with a `defaultImpl` or similar fallback, accepts user-influenced type IDs, and utilizes a long-lived `ObjectMapper` across requests.

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker. This action can occur before the connection authentication and authorization stage or at any time thereafter.

An integer underflow exists in the DHCPv4 packet capture code of the `wickedd-dhcp4` client. The function `ni capture inspect udp header()` in `src/capture.c` fails to verify that the IP total length field `ip len` is at least as large as the IP header length `ihl` before performing subtraction. An unauthenticated attacker on the same network can exploit this to trigger an out-of-bounds read past the receive buffer, potentially causing the daemon to crash depending on the process memory layout.

An out-of-bounds read exists in the DHCPv4 packet capture code. The function `ni capture inspect udp header()` in `src/capture.c` incorrectly reports the IP total length as the payload length instead of the remaining UDP payload length. This causes the DHCP option walker in the DHCPv4 client (`wickedd-dhcp4`) to read up to 68 bytes beyond the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to force the client to parse adjacent heap memory as DHCP options, potentially allowing heap contents like allocator metadata or pointer values to be interpreted as lease fields.

يمكن أن يؤدي تجاوز سعة المخزن المؤقت القائم على الـ”هيوب“ في محرك التحليل إلى تعطل البرنامج، مما يؤدي إلى رفض الخدمة. يحدث تجاوز سعة المخزن المؤقت القائم على الـ”هيوب“ عندما يكتب البرنامج بيانات إلى مخزن مؤقت ذاكرة الـ”هيوب“ أكثر مما يمكنه استيعابه، مما قد يؤدي إلى إتلاف الذاكرة.

A flaw in the TTL file parser can lead to an infinite loop, resulting in a denial of service.

A crash in the PEAK CAN TRC file parser can lead to a denial of service.