Jaroslav Lobačevski

تم تحديد مشكلة حرجة في منظمة WilderForge، ناجمة عن الاستخدام غير الآمن للمتغيرات التي يتحكم فيها المستخدم، مثل `${{ github.event.review.body }}`، مباشرةً داخل سياقات نصوص شل في سير عمل GitHub Actions. يؤدي ذلك إلى حدوث مشكلة حقن كود، مما يسمح لمهاجم خبيث بتنفيذ كود شل تعسفي على مشغل GitHub Actions عند إرسال مراجعة طلب سحب (pull request) تم التلاعب بها. وقد يؤدي ذلك إلى التنفيذ التعسفي للأوامر باستخدام أذونات سير العمل، مما قد يعرض البنية التحتية لـ CI والأسرار ومخرجات البناء للخطر. تؤثر هذه المشكلة على المطورين الذين يديرون مستودعات WilderForge المحددة أو يساهمون فيها، وكذلك المستخدمين الذين يقومون بإنشاء فروع من هذه المستودعات ويعيدون استخدام سير عمل GitHub Actions المتأثرة. لا يتأثر المستخدمون النهائيون للبرنامج والمستخدمون الذين يقومون فقط بتثبيت الإصدارات المُجمَّعة مسبقًا أو الأرتيفاكتات.

7-Zip هو برنامج ضغط ملفات يدعم استخراج الملفات المركبة. قد يؤدي الوصول إلى مؤشر فارغ في معالج الملفات المركبة إلى حدوث رفض الخدمة.

7-Zip هو برنامج ضغط ملفات يتميز بنسبة ضغط عالية. يوجد عيب في معالج RAR5 حيث يمكن أن تؤدي كتابة أصفار خارج مخزن الذاكرة المؤقت (heap buffer) إلى تلف الذاكرة وحجب الخدمة.

The issue is related to a crafted image file that may trigger an out of bounds memcpy read in the `stbi gif load next` function. This occurs because `two back` points to a memory address lower than the start of the buffer, potentially leading to the leak of internal memory allocation information.

The issue is related to the stbi getn function in the stb image library, which reads a specified number of bytes from a context into a buffer. If the file stream points to the end, it returns zero. However, there are two places where its return value is not checked: in the `stbi hdr load` function and in the `stbi tga load` function. The latter is likely more exploitable as an attacker may also control the size of an uninitialized buffer.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in `f->vendor[i] = get8 packet(f);`. This is caused by an integer overflow in `setup malloc`, where a sufficiently large value in the variable `sz` overflows when added to 7, resulting in a negative value that passes the maximum available memory buffer check. This may lead to code execution.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of buffer write in the `start decoder` function. This occurs because the maximum value of `m->submaps` is 16, but the arrays `submap floor` and `submap residue` are declared with 15 elements. This can potentially lead to code execution.

The issue is related to a memory allocation failure in the `start decoder` function when processing a crafted ogg vorbis file. This failure causes the function to return early, setting `f->comment list` to `NULL` but not resetting `f->comment list length`. Later, in the `vorbis deinit` function, it attempts to dereference the `NULL` pointer, potentially leading to a denial of service.

The issue concerns a crafted file that may trigger an out of bounds read in the `DECODE` macro when the `var` is negative. According to the definition of `DECODE RAW`, a negative `var` is a valid value. This can potentially be used to leak internal memory allocation information.

The issue is related to a global buffer read overflow in the `CharDistributionAnalysis::HandleOneChar` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a global buffer read overflow in the `nsCodingStateMachine::NextStater` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a heap buffer read overflow in the `FileManager::detectLanguageFromTextBegining()` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a heap buffer write overflow in the `Utf8 16 Read::convert` function, which may lead to arbitrary code execution when a user opens a specially crafted file. This can potentially allow an attacker to execute arbitrary code.

The issue is related to the `stbi load gif main` function in the stb image library, which may lead to a memory leak or double-free if the caller chooses to free the `delays` memory only when the function returns a non-null value. The function may return a null value but fail to free the memory in `delays` if internally `stbi convert format` is called and fails. This could allow a remote attacker to access confidential data, compromise its integrity, or cause a denial of service.

The issue is related to a potential integer overflow in `sizeof(char*) * (f->comment list length)` which may cause `setup malloc` to allocate less memory than required. This can lead to a memory write past an allocated heap buffer in `start decoder` when a crafted file is processed. An attacker may exploit this issue to gain access to confidential data, disrupt data integrity, and cause a denial of service. The issue may also lead to code execution.

The issue is related to the `stbi set flip vertically on load` function in the stb image library. When this function is set to `TRUE` and `req comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. This can trigger an out-of-bounds read in `memcpy` because `bytes per pixel` used to calculate `bytes per row` doesn’t match the real image array dimensions. A crafted image file can exploit this, potentially allowing a remote attacker to access confidential data or cause a denial of service.

The issue is related to a crafted file that may trigger an out of bounds write in `f->vendor[len] = (char)'0';`. This occurs when the length read in `start decoder` is `-1` and `len + 1` becomes 0 when passed to `setup malloc`. The `setup malloc` function behaves differently when `f->alloc.alloc buffer` is pre-allocated, shifting the pre-allocated buffer by zero and returning the currently available memory block instead of returning `NULL` as in the `malloc` case. This may lead to code execution. The vulnerability may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted file.

The issue is related to json parsing in jsonxx, which may lead to stack exhaustion in an address sanitized (ASAN) build. This can cause a Denial of Service if the program using the jsonxx library crashes. The project has been archived, and updates are not expected.

The issue is related to the use of the Value class in jsonxx, which may lead to memory corruption via a double free or a use after free. This occurs because the Value class has a default assignment operator that can be used with pointer types, potentially pointing to alterable data without updating the pointer itself. The jsonxx project has been archived, and no updates are expected.

The issue is related to a security problem, but details are not provided.