Fabian Wahle

**Name of the Vulnerable Software and Affected Versions** libexpat versions prior to 2.9.0 **Description** A heap buffer over-read exists in the `xmlparse.c` file. The `XML ParseBuffer()` function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer size. Repeated calls to `XML ParseBuffer()` can move the `m bufferEnd` variable past the end of the heap allocation, causing subsequent parsing to read out of bounds. This path is reachable if a parse buffer is already present, which occurs after a call to `XML GetBuffer()` or an internal allocation via `XML Parse()`. This issue allows the disclosure of adjacent heap memory, which can leak heap pointers, libc function pointers, and code pointers, potentially defeating Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to make exploitation harder. **Recommendations** Update libexpat to version 2.9.0. As a temporary mitigation, restrict the use of the `XML ParseBuffer()` function with attacker-influenced or oversized lengths.

**Name of the Vulnerable Software and Affected Versions** PyPy versions prior to 3.11.16 PyPy versions prior to 3.12.14 **Description** A use-after-free issue exists in the `pyexpat` module's `ExternalEntityParserCreate()` function. This occurs when applications create external-entity sub-parsers without maintaining a reference to the parent parser. The child parser keeps a raw C back-pointer to the parent parser struct, but the tracing garbage collector may free the parent's C struct. Consequently, the bundled libexpat dereferences this freed pointer during token parsing, leading to memory corruption via a specially crafted XML document. **Recommendations** Update to version 3.11.16 or later. Update to version 3.12.14 or later.

**Name of the Vulnerable Software and Affected Versions** VLC media player versions prior to 3.0.24 **Description** A path traversal issue exists in the skins2 ThemeLoader due to insufficient validation of member names within .vlt skin archives. This allows an attacker to use path traversal sequences in malicious skin files to write arbitrary files with the privileges of the VLC user, which can lead to code execution via Lua script injection. **Recommendations** Update to version 3.0.24 or later.

**Name of the Vulnerable Software and Affected Versions** VLC media player versions 3.0.0 through 3.0.23 **Description** A memory-safety issue exists when processing crafted media, caused by an integer overflow. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is too large to be stored in the allotted memory space. Exploitation requires user interaction and may lead to application termination or arbitrary code execution with the privileges of the VLC process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VLC media player versions 3.0.0 through 3.0.23 **Description** A memory-safety issue exists when processing media from an attacker-controlled network source. This flaw involves an out-of-bounds read, which may allow a remote attacker to disclose a limited amount of process memory. The extent of the exposure depends on the build configuration and requires user interaction to be exploited. **Recommendations** Update VLC media player to a version later than 3.0.23.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Expat الأقدم من 2.8.4 **الوصف** توجد مشكلة رفض الخدمة بسبب التعقيد الخوارزمي التربيعي داخل الدالة `storeAtts()` في xmlparse.c. عند معالجة N من السمات المحددة ذات القيم غير المعيارية، يقوم النظام بتشغيل مسح خطي O(N^2) لـ `elementType->defaultAtts` لتحديد حالة CDATA. يمكن لمهاجم بعيد غير مصدق أن يتسبب في استهلاك مفرط لوحدة المعالجة المركزية (CPU) عن طريق تزويد تطبيق يقوم بتحليل XML غير موثوق به بوثيقة XML واحدة جيدة التكوين بحجم بضعة ميغابايت. **التوصيات** التحديث إلى الإصدار 2.8.4 أو أحدث.