Joonas Kuorilehto

The issue allows local users with storage vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name, when fine-grained Access Control Lists (ACL) are in effect. This is due to a directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage backend fs.c.

The issue allows remote attackers to cause a denial of service, leading to an assertion failure and device restart, via an invalid packet fragment.

The issue is related to the handling of incorrect frame lengths, which can be exploited by remote attackers to cause a denial of service. This can be achieved by associating with the access point and then sending a short frame, resulting in a device crash.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, by utilizing a JPEG image with a crafted sequence of restart markers. This is related to the JPEGWarningHandler function in coders/jpeg.c.

The issue allows remote attackers to cause a denial of service, potentially leading to memory corruption, and possibly execute arbitrary code. This is achieved through crafted offset and count values in the `ResolutionUnit` tag within the EXIF IFD0 of an image.

The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read and crash, via a crafted EXIF IFD in a TIFF image. This is due to a problem in the TIFFGetEXIFProperties function in coders/tiff.c.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and hang, by providing a crafted image. This image has an IFD that contains IOP tags, all of which reference the beginning of the IDF.

The issue allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read. This occurs due to a problem in the GetEXIFProperty function in magick/property.c.

The issue is related to a buffer overflow in the read server hello function in lib/gnutls handshake.c in GnuTLS, which allows remote servers to cause a denial of service or possibly execute arbitrary code via a long session id in a ServerHello message. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.