Joshua J. Drake

قد يؤدي انخفاض قيمة عدد صحيح (التفاف أو الالتفاف الكامل) في المكتبات الأساسية إلى قراءة زائدة في المخزن المؤقت. يحدث انخفاض قيمة عدد صحيح عندما تسفر عملية حسابية عن قيمة أصغر من الحد الأدنى للقيمة التي يمكن أن تحتويها المتغير، مما يتسبب في التفافها إلى رقم موجب كبير جدًا.

تسمح مشكلة القراءة خارج النطاق في المكتبات الأساسية (Core Libraries) بحدوث تجاوز في قراءة المخازن المؤقتة (buffers)، وهو ما يحدث عندما يقرأ البرنامج البيانات إلى ما بعد نهاية المخزن المؤقت المقصود.

توجد مشكلة قراءة خارج النطاق في المكتبات الأساسية تسمح بقراءة أكثر من سعة المخازن المؤقتة. تحدث القراءة خارج النطاق عندما يقرأ البرنامج بيانات من عنوان ذاكرة خارج حدود المخزن المؤقت المقصود.

The issue is related to a buffer overflow in memory, allowing remote attackers to execute arbitrary code by opening a specially crafted file. This can affect the system. The vulnerability is associated with the RTF parser and can be triggered with a table of fonts containing an excessive number of entries. It has been reported that a proof-of-concept exploit is available, which can be chained with other vulnerabilities to achieve remote code execution.

The issue is related to an untrusted search path vulnerability in the OSA Scripts component of Apple OS X. This vulnerability allows attackers to load arbitrary script libraries via a quarantined application, potentially enabling remote attackers to exploit the system.

The issue is related to the syslog component in the affected operating systems, caused by a buffer overflow. This can be exploited by a local attacker to gain privileges or cause a denial of service, resulting in memory corruption.

The issue is related to a buffer overflow in the dynamic memory of the libstagefright library, caused by an integer overflow. This can be exploited by a remote attacker using a specially crafted MP4 file, potentially allowing the execution of arbitrary code or causing a denial of service.

The issue is related to the MPEG4Extractor::parse3GPPMetaData function in the libstagefright library, which does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM). This allows remote attackers to cause a denial of service, including integer underflow, buffer over-read, and mediaserver process crash, via crafted 3GPP metadata. The vulnerability is also associated with an integer overflow.

The issue is related to an off-by-one error in the `MPEG4Extractor::parseChunk` function, which can lead to an integer overflow and memory corruption. This can be exploited by remote attackers using crafted MPEG-4 covr atoms with a size equal to `SIZE MAX`. The exploitation may result in the execution of arbitrary code or a denial of service. The vulnerability is associated with an integer overflow in the `libstagefright` library of the Android operating system.

The issue is related to the MPEG4Extractor::parse3GPPMetaData function in the libstagefright library, which does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM). This allows remote attackers to execute arbitrary code or cause a denial of service via crafted 3GPP metadata, resulting in integer underflow and memory corruption. The vulnerability can be exploited to remotely execute code in affected devices.

The issue is related to an integer underflow in the `MPEG4Extractor::parseChunk` function of the libstagefright library in Android. This can be exploited by a remote attacker using specially crafted MPEG-4 data, potentially allowing the execution of arbitrary code or causing a denial of service due to memory corruption. The vulnerability can be triggered via crafted MPEG-4 covr atoms.

The issue is related to the MPEG4Extractor::parseChunk function in the libstagefright library, which does not properly restrict size addition. This allows remote attackers to execute arbitrary code or cause a denial of service due to integer overflow and memory corruption via a crafted MPEG-4 tx3g atom. The vulnerability can be exploited by sending specially crafted data in the MPEG-4 format, potentially leading to remote code execution or a denial of service.

The issue is related to multiple integer underflows in the ESDS::parseESDescriptor function of the libstagefright library in the Android operating system. This can be exploited by a remote attacker to execute arbitrary code using specially crafted ESDS data. The vulnerability allows for the execution of code via crafted ESDS atoms.

The issue is related to an integer overflow in the `SampleTable::setSampleToChunkParams` function in `libstagefright` in Android. This allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication. The vulnerability can be exploited to remotely execute code in affected devices.

The issue is related to multiple integer overflows in the libstagefright library, which can be exploited by remote attackers to execute arbitrary code. This can be achieved through crafted sample metadata in an MPEG-4 video file.

A security feature bypass issue exists due to the improper loading of structured exception handling tables by the kernel. This allows attackers to bypass the SafeSEH security feature, potentially facilitating the exploitation of other vulnerabilities.

The issue is related to the LDAP service in Active Directory, which does not properly free memory for LDAP and LDAPS requests. This allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released. The problem is associated with a "DN AttributeValue" and is probably a memory leak.

The issue arises from improper validation of data in the VBA Performance Cache when processing an Office document with an embedded object. This allows remote attackers to execute arbitrary code via a crafted Excel file, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption. A remote code execution vulnerability exists in the way Excel processes a VBA Performance Cache, which could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file.

The issue allows local users to create arbitrary files via unspecified vectors, including scenarios where an attacker's umask is honored. Additionally, it involves the `/etc/ld.so.preload` file, certain cron data file locations, and possibly the `OSSEMEMDBG` or `TRC LOG FILE` environment variables in `db2licd` (`db2licm`).

The issue is related to improper termination of certain input strings, which can lead to a heap-based buffer overflow. This allows local users to execute arbitrary code via unspecified environment variables.