Marco Nelissen

تتعلق المشكلة بوظيفة iomap write delalloc scan() في نواة Linux، والتي قد تؤدي إلى حلقة لا نهائية بسبب اقتطاع الأرقام عند الكتابة إلى نظام ملفات xfs على النوى ذات 32 بت. يحدث هذا لأن وظيفة folio next index() تُرجع قيمة من نوع unsigned long، مما يتسبب في قيام وظيفة iomap write delalloc scan() باستخدام موضع 32 بت عن غير قصد. لم يتم تحديد العدد التقديري للأجهزة التي قد تتأثر بهذه المشكلة. ولا توجد معلومات عن حوادث فعلية تم فيها استغلال هذه المشكلة.

تتعلق المشكلة بوظيفة `folio seek hole data()` في نواة Linux، التي تقوم عن غير قصد باقتطاع قيمة من 64 بت إلى 32 بت في النوى ذات 32 بت. وقد يؤدي ذلك إلى حدوث حلقة لا نهائية محتملة عند الكتابة في نظام ملفات xfs. وقد تسمح هذه الثغرة الأمنية لمهاجم بإحداث حالة رفض الخدمة.

The issue allows remote attackers to execute arbitrary code or cause a denial of service via crafted EXIF data. This is due to a buffer overflow in the exif.c file of the jhead tool, which is used in the libjhead library in Android.

The issue is related to the libstagefright component in the mediaserver of the Android operating system, which does not validate OMX buffer sizes for the GSM and G711 codecs. This allows attackers to gain privileges via a crafted application, potentially obtaining Signature or SignatureOrSystem access. The exploitation of this issue can enable a remote attacker to elevate their privileges using a specially crafted application.

The issue is related to the mediaserver in Android, which does not validate OMX buffer sizes. This allows attackers to gain privileges via a crafted application, potentially obtaining Signature or SignatureOrSystem access. The vulnerability can be exploited by a remote attacker using a specially crafted application to elevate their privileges.

The issue allows attackers to obtain sensitive information from process memory and bypass an unspecified protection mechanism via unspecified vectors. This can be demonstrated by obtaining Signature or SignatureOrSystem access. The vulnerability is related to the media/libmedia/IOMX.cpp component in the mediaserver of the Android operating system, which does not initialize a parameter data structure.

The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This is due to an out-of-bounds read and memory corruption in the MPEG4Extractor.cpp function of the libstagefright library in the mediaserver component. The exploitation of this issue can lead to the execution of arbitrary code or a denial of service.

The issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. This is due to insufficient input validation in the `MPEG4Source::fragmentedRead` function.

The issue is related to multiple integer overflows in the `addVorbisCodecInfo` function in `matroska/MatroskaExtractor.cpp` in `libstagefright` in `mediaserver`. This allows remote attackers to cause a denial of service, leading to device inoperability, via crafted Matroska data.