Asarubboo

An issue was discovered in libbzip3.a in bzip3. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.

An issue was discovered in libbzip3.a. There is an out-of-bounds write in the `bz3 decode block` function.

An issue was discovered in libbzip3.a. There is a crash caused by an invalid memmove in `bz3 decode block`.

An issue was discovered in libbzip3.a. There is a bz3 decode block out-of-bounds read.

An issue was discovered in libbzip3.a. There is an xwrite out-of-bounds read.

An issue was discovered in libbzip3.a where there is a `bz3 decompress` out-of-bounds read in certain situations. This occurs when buffers passed to bzip3 do not contain enough space to be filled with decompressed data. The vendor's perspective is that the observed behavior can only occur for a contract violation.

An issue was discovered in libbzip3.a in bzip3. A `bz3 decode block` out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with `libsais`.

Uma falha no drachtio-server permite que invasores remotos provoquem uma negação de serviço, resultando na falha do daemon. Isso é feito através do envio de uma mensagem longa em uma solicitação TCP, o que leva a um erro std::length error.

Uma falha no fork libsofia-sip permite que invasores remotos provoquem uma negação de serviço por meio de uma mensagem UDP maliciosa, levando à falha do daemon devido a uma falha na auto-assertão do arquivo libsofia-sip-ua/tport/tport.c. A função config sortlist também não possui verificações de validade da string de entrada, o que pode permitir um estouro de pilha de comprimento arbitrário.

Uma falha no fork libsofia-sip permite que invasores remotos provoquem uma negação de serviço por meio de uma mensagem UDP maliciosa, resultando em uma leitura excessiva do buffer baseada na pilha devido a um erro de deslocamento de um. Isso pode causar a falha do daemon.

O problema diz respeito às permissões do diretório /var/log/drachtio e do arquivo drachtio.log. Especificamente, o diretório possui um modo de 0777 e o arquivo de log possui um modo de 0666. Isso poderia permitir o acesso não autorizado ou a modificação dos arquivos de log.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted archive. This is due to a problem in the bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so.

The issue allows local users to obtain sensitive authentication information via standard filesystem operations due to the use of 0755 permissions for the $HOME/.TelegramDesktop directory.

The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.

The issue allows remote attackers to cause a denial of service (crash) via a crafted file. This is due to the `decodeSample` function in `IMA.cpp`.

The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read and crash, via a crafted file. This is related to the `IsPixelMonochrome` function in `MagickCore/pixel-accessor.h`. The vendor has stated that this issue is specific to Q64, which they do not support.

The issue is related to the `AcquireMagickMemory` function in `MagickCore/memory.c`, which allows remote attackers to have an unspecified impact through a crafted image. This triggers a memory allocation failure. The problem exists due to an incomplete fix.

The issue is related to the AcquireQuantumPixels function in MagickCore/quantum.c, which can be exploited by remote attackers using a crafted image file. This exploitation can trigger a memory allocation failure, potentially leading to unspecified impact.

The issue is related to the AcquireMagickMemory function in MagickCore/memory.c, which allows remote attackers to have an unspecified impact via a crafted image. This is triggered by a memory allocation failure.