Ostif-Derek

On Windows, filesystem and stream APIs fail to reject reserved device names when they are part of a path. These reserved names include CON, PRN, AUX, NUL, COM1 through COM9, LPT1 through LPT9, CONIN$, and CONOUT$. Consequently, an attacker-controlled filename can reach the `CreateFileW()` function and open a device instead of a standard file. This behavior can lead to a Denial of Service (DoS) by blocking or hanging requests and exhausting worker processes.

The `phar tar number()` function parses the octal size field of a TAR header into a `uint32 t` without an overflow check. Because the field is 11 octal digits wide and can hold values up to 0x1FFFFFFFF, any size exceeding 0xFFFFFFFF silently wraps. This causes the parser to skip an incorrect number of data blocks and interpret attacker-controlled file content as the subsequent TAR header, allowing a crafted archive to inject entries that PharData reports and extracts as genuine.

The mysqlnd wire protocol parser reads fields from server packets without first verifying if the packet contains sufficient bytes. This allows a malicious or compromised MySQL server to send a truncated packet, causing the client to read beyond the packet buffer. This undefined behavior can lead to a process crash.

The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the `listen.allowed clients` check to match based on a /96 prefix rather than the exact address. An attacker using an address that shares the first 96 bits with an authorized address can bypass the access control and reach the FastCGI endpoint.