Tristan Madani

**اسم البرنامج المصاب والإصدارات المتأثرة** Open5GS الإصدارات السابقة لـ 2.8.1 **Description** يحدث خطأ في القراءة خارج حدود الذاكرة المكدسة (heap out-of-bounds read) في الدالة `ogs pfcp parse dropped dl traffic threshold()`. يمكن للمهاجمين عن بُعد غير المصرح لهم القراءة بعد مخازن عناصر المعلومات (IE) عبر إرسال عناصر معلومات قصيرة. يتم ذلك عن طريق إرسال طلبات إنشاء أو تعديل جلسة PFCP إلى وظيفة مستوى المستخدم (UPF) على منفذ UDP 8805 مع تعيين أعلام `DLPA` و `DLBY` مما قد يؤدي إلى تعطل الـ UPF. **Recommendations** التحديث إلى إصدار أحدث من 2.8.0.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.8.1 **Description** A heap out-of-bounds read occurs in the `ogs pfcp parse volume measurement()` function within `lib/pfcp/types.c`. Remote unauthenticated attackers can exploit this by sending a PFCP Session Report Request to the Session Management Function (SMF) on UDP port 8805. By using a short Volume Measurement Information Element (IE) with all flags set, an attacker can read up to 48 bytes beyond the IE buffers, which may lead to a crash of the SMF. **Recommendations** Update to version 2.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.8.1 **Description** A reachable assertion issue exists in the `mme gn handle sgsn context request()` function. Remote unauthenticated attackers can cause the MME to crash by sending malformed SGSN Address IEs via GTPv1-C traffic from a configured SGSN address using a known UE IMSI or P-TMSI. By providing an invalid address length, an attacker can terminate the open5gs-mmed process, resulting in a denial of service for all subscribers. **Recommendations** Update to version 2.8.1 or later.

**اسم البرنامج المصاب والإصدارات المتأثرة** MIT krb5 الإصدارات السابقة لـ 1.22.3 **Description** يحدث إلغاء مرجع المؤشر NULL في دالة `get pac princ with realm()` الخاصة بـ KDC عند معالجة أسماء مشوهة، حيث تعيد الدالة نتيجة نجاح بينما تترك principal العميل NULL. يمكن لـ KDC موثوق عبر النطاقات (cross-realm) يكون خبيثاً أو مخترقاً استغلال ذلك عن طريق إرسال طلب S4U2Proxy يحتوي على PAC يحمل اسماً مشوهاً للعميل، مما يؤدي إلى تعطل خدمة krb5kdc ومنع المصادقة. **Recommendations** تحديث MIT krb5 إلى الإصدار 1.22.3 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** MIT Kerberos 5 (krb5) versions prior to 1.22.3 **Description** A NULL pointer dereference occurs in the `make cred list()` function within `rd cred.c`. Authenticated Kerberos clients can trigger this by sending mismatched KRB-CRED arrays. Specifically, an attacker can send forwarded credentials containing more tickets than `ticket info` entries through the `gss accept sec context()` function, leading to a crash of GSS-API acceptor services and resulting in a denial of service. **Recommendations** Update MIT Kerberos 5 (krb5) to version 1.22.3 or later.

**Name of the Vulnerable Software and Affected Versions** tftp-hpa versions 5.4 through 5.9 **Description** An out-of-bounds read occurs in the `rewrite string()` function within tftpd/remap.c during jump label searches, causing the process to walk heap memory. Unauthenticated remote attackers can trigger this by sending read or write requests with a filename that matches a remap jump rule, leading to a crash of the forked in.tftpd request handler. **Recommendations** Update tftp-hpa to version 6.0.

**Name of the Vulnerable Software and Affected Versions** lrzsz versions prior to 0.13.0 **Description** The `lrz` receive utility contains an OS command injection flaw in its pipe mode. This occurs when `lrz` is executed under a suffixed name, such as `lrztar`, causing the `procheader()` function in `src/lrz.c` to pass an unescaped ZMODEM or YMODEM filename directly to `popen()`. Consequently, a remote sender can execute arbitrary commands as the receiving user by providing a specially crafted filename containing shell metacharacters. **Recommendations** Update lrzsz to version 0.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** libmikmod versions prior to 3.3.14 **Description** An integer overflow exists in the Oktalyzer loader `OKT doPBOD()` function. An attacker can exploit this by providing a crafted OKT module where the SLEN chunk wraps the 16-bit `numtrk` value. This leads to a heap buffer overflow, where PBOD writes occur beyond the allocated track pointers, potentially resulting in application crashes or arbitrary code execution. **Recommendations** Update libmikmod to version 3.3.14 or later.

**Name of the Vulnerable Software and Affected Versions** lrzsz versions prior to 0.13.0 **Description** The `lrz` receive utility contains a path traversal issue in its restricted mode. This occurs because the `checkpath()` function in `src/lrz.c` only filters out `../` sequences when not built with the `--enable-pubdir` option. Consequently, a malicious ZMODEM sender can use absolute pathnames to write files outside the intended directory and overwrite any file that the receiving user has permissions to modify. **Recommendations** Update lrzsz to version 0.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** libmikmod versions prior to 3.3.14 **Description** A heap out-of-bounds read exists in the Impulse Tracker loader `load it.c`. An attacker can provide a specially crafted IT module containing more than 200 pattern rows, which causes the `IT ConvertTrack()` function to read beyond the `itpat` buffer. This memory access error can lead to the disclosure of adjacent heap memory or cause the application to crash. **Recommendations** Update libmikmod to version 3.3.14 or later.

**Name of the Vulnerable Software and Affected Versions** libmikmod versions prior to 3.3.14 **Description** An integer overflow exists in the `DSM Load()` function within load dsm.c. This occurs when a DSM module is supplied where the product of `numchn` and `numpat` wraps a 16-bit value, leading to a heap buffer overflow. This memory corruption can result in application crashes or potential arbitrary code execution. **Recommendations** Update libmikmod to version 3.3.14 or later.

**Name of the Vulnerable Software and Affected Versions** lrzsz versions prior to 0.13.0 **Description** A heap-based buffer overflow occurs in the `procheader()` function of the lrz receive utility. This issue arises when the utility copies excessively long filenames provided by a sender into the `Pathname` variable. A malicious ZMODEM sender can provide filenames up to 8192 bytes, causing a buffer overflow via `sprintf()` in pipe mode or `strcpy()`, which leads to heap memory corruption and application crashes. **Recommendations** Update lrzsz to version 0.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** DCMTK versions prior to 3.7.1 **Description** A heap over-read occurs in the ConcatenationLoader when copying pixel data frames. The issue arises because the software fails to validate the `PixelData` buffer length against the declared `NumberOfFrames`. An attacker can use a specially crafted DICOM instance that declares more frames than the buffer actually contains, leading to an application crash or the leakage of adjacent heap memory. **Recommendations** Update to a version newer than 3.7.0.

**Name of the Vulnerable Software and Affected Versions** Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 **Description** A flaw in the `helidon-webclient-http2` component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a frequently repeatable crash, resulting in a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to its intended users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SIPp versions prior to 3.7.8 **Description** A buffer overflow occurs in the `get header()` function within src/sip parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer, leading to a process crash. **Recommendations** Update to a version newer than 3.7.7.

**Name of the Vulnerable Software and Affected Versions** SIPp versions prior to 3.7.8 **Description** A stack buffer overflow occurs in the `createAuthHeader()` function when processing SIP authentication challenges that contain oversized algorithm parameters. A malicious SIP server can exploit this by sending a specially crafted 401 or 407 challenge, leading to stack corruption and a crash of the client process. **Recommendations** Update to a version newer than 3.7.7.

**Name of the Vulnerable Software and Affected Versions** MKVToolNix versions prior to 101.0-2.1 **Description** A heap buffer overflow exists in the bundled avilib library's ODML superindex parser. This occurs due to integer wraparound in 32-bit arithmetic, where a malicious AVI file containing oversized entry counts can trigger an undersized heap allocation. This condition allows for a heap buffer overflow when the file is processed by the `mkvmerge` tool. **Recommendations** Update to version 101.0-2.1.

**Name of the Vulnerable Software and Affected Versions** SIPp versions prior to 3.7.8 **Description** A buffer overflow occurs in the `get peer tag()` function when processing SIP To headers. Unauthenticated remote attackers can send crafted SIP messages containing `tag` parameters of 2049 bytes or more to overflow a static buffer, resulting in a process crash. **Recommendations** Update to a version newer than 3.7.7.

**Name of the Vulnerable Software and Affected Versions** Freeciv versions 3.1.0 through 3.2.5 **Description** An out-of-bounds read occurs in the `sg load player unit()` function when processing savegame files containing invalid unit activity indices. A malicious savegame file with an out-of-range activity index can bypass bounds checking, leading to a crash or limited heap memory exposure during the loading process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sngrep versions prior to 1.8.4-2.1 **Description** Stack buffer overflow issues exist in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. An attacker can send malicious SIP packets containing oversized header fields, such as `Call-ID` or `X-Call-ID`, to overflow stack buffers. This can lead to application crashes or the execution of arbitrary code during the parsing and rendering of packets. **Recommendations** Update sngrep to version 1.8.4-2.1 or later.