Jarlob

توجد مشكلة تكرار غير خاضع للرقابة في محلل صور نظام الملفات UFS/UFS2. تقوم الدالة `GetAllPaths()` بالتكرار داخل الدلائل الفرعية دون حدود للعمق أو تتبع العقد (inode) التي تمت زيارتها. يمكن أن تؤدي صورة UFS مصممة خصيصًا تحتوي على دورة عقد (inode) أو شجرة دلائل عميقة إلى استنفاد المكدس، مما يؤدي إلى تعطل العملية.

توجد ثغرة قراءة خارج نطاق المسموح به تعتمد على المكدس في محلل صور نظام الملفات ZealFS. يحدث هذا عند فتح صورة نظام ملفات ZealFS v1 مصممة خصيصًا، حيث يؤدي حقل `BitmapSize` الذي يتحكم فيه المهاجم في رأس الملف إلى تشغيل حلقة غير محدودة تقرأ ما بعد نهاية بنية `ZEALFS V1 HEADER` المخصصة في المكدس.

يوجد ثغرة في محلل صور نظام الملفات UFS/UFS2 تتمثل في كتابة قيمة ”null“ خارج حدود الذاكرة المؤقتة (heap) بحجم بايت واحد. تحدث هذه الثغرة عند فتح صورة نظام ملفات UFS مصممة خصيصًا لهذا الغرض، مما يسمح للمهاجم بالتحكم في إزاحة البايت للكتابة ضمن نافذة تبلغ حوالي 254 بايت خارج حدود تخصيص الذاكرة المؤقتة.

يحتوي OpenCV، وهو مكتبة مفتوحة المصدر للرؤية الحاسوبية، على ثغرة أمنية يمكن أن تؤدي فيها متغير مؤشر غير مُهيَّأ في المكدس (stack) إلى كتابة تعسفية في المخزن المؤقت (buffer) في الذاكرة المؤقتة (heap) عند معالجة صور JPEG تم التلاعب بها.

7-Zip هو برنامج ضغط ملفات يتميز بنسبة ضغط عالية. يوجد عيب في معالج RAR5 حيث يمكن أن تؤدي كتابة أصفار خارج مخزن الذاكرة المؤقت (heap buffer) إلى تلف الذاكرة وحجب الخدمة.

7-Zip هو برنامج ضغط ملفات يدعم استخراج الملفات المركبة. قد يؤدي الوصول إلى مؤشر فارغ في معالج الملفات المركبة إلى حدوث رفض الخدمة.

The issue concerns command-line audio/video downloaders `yt-dlp` and `youtube-dl`. Prior to the fixed versions, these tools do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since `yt-dlp` and `youtube-dl` also read config from the working directory, this could lead to arbitrary code being executed. To mitigate this, users should have `.%(ext)s` at the end of the output template, trust the websites they download from, and avoid downloading to sensitive locations.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in `f->vendor[i] = get8 packet(f);`. This is caused by an integer overflow in `setup malloc`, where a sufficiently large value in the variable `sz` overflows when added to 7, resulting in a negative value that passes the maximum available memory buffer check. This may lead to code execution.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of buffer write in the `start decoder` function. This occurs because the maximum value of `m->submaps` is 16, but the arrays `submap floor` and `submap residue` are declared with 15 elements. This can potentially lead to code execution.

The issue is related to the processing of ogg vorbis files. A crafted file can cause a memory allocation failure in the `start decoder` function, leading to some pointers in `f->comment list` being left initialized. Later, `setup free` is called on these pointers in `vorbis deinit`, which may result in code execution.

The issue concerns a crafted file that may trigger an out of bounds read in the `DECODE` macro when the `var` is negative. According to the definition of `DECODE RAW`, a negative `var` is a valid value. This can potentially be used to leak internal memory allocation information.

The issue is related to a memory allocation failure in the `start decoder` function when processing a crafted ogg vorbis file. This failure causes the function to return early, setting `f->comment list` to `NULL` but not resetting `f->comment list length`. Later, in the `vorbis deinit` function, it attempts to dereference the `NULL` pointer, potentially leading to a denial of service.

The issue is related to the stbi getn function in the stb image library, which reads a specified number of bytes from a context into a buffer. If the file stream points to the end, it returns zero. However, there are two places where its return value is not checked: in the `stbi hdr load` function and in the `stbi tga load` function. The latter is likely more exploitable as an attacker may also control the size of an uninitialized buffer.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in `f->vendor[len] = (char)'0';`. This occurs when `len` read in `start decoder` is a negative number and memory allocation is successful, but the memory write is done with a negative index `len`. Additionally, if `len` is INT MAX, an integer overflow happens in `f->vendor = (char*)setup malloc(f, sizeof(char) * (len+1));` and `f->comment list[i] = (char*)setup malloc(f, sizeof(char) * (len+1));`. This may lead to code execution.

The issue is related to a crafted image file that may trigger an out of bounds memcpy read in the `stbi gif load next` function. This occurs because `two back` points to a memory address lower than the start of the buffer, potentially leading to the leak of internal memory allocation information.

The issue is related to a global buffer read overflow in the `nsCodingStateMachine::NextStater` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a heap buffer read overflow in the `FileManager::detectLanguageFromTextBegining()` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a crafted file that may trigger an out of bounds write in `f->vendor[len] = (char)'0';`. This occurs when the length read in `start decoder` is `-1` and `len + 1` becomes 0 when passed to `setup malloc`. The `setup malloc` function behaves differently when `f->alloc.alloc buffer` is pre-allocated, shifting the pre-allocated buffer by zero and returning the currently available memory block instead of returning `NULL` as in the `malloc` case. This may lead to code execution. The vulnerability may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted file.

The issue is related to the stbi load gif from memory component of the stb image library, which is a single file MIT licensed library for processing images. If `stbi load gif main` fails, it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi vertical flip slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to a potential integer overflow in `sizeof(char*) * (f->comment list length)` which may cause `setup malloc` to allocate less memory than required. This can lead to a memory write past an allocated heap buffer in `start decoder` when a crafted file is processed. An attacker may exploit this issue to gain access to confidential data, disrupt data integrity, and cause a denial of service. The issue may also lead to code execution.