Haind

SDL mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2 schunk get slice buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2 schunk open() or blosc2 schunk from buffer() and read as a slice, raising SIGFPE and terminating the process.

SDL mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

sngrep through 1.9.0 contains an infinite loop vulnerability in capture packet reasm ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.

libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu parse stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip check packet and sip validate packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in zbar sq decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

Ocorre uma leitura fora dos limites na função `m se decode()` em `src/decode.c`. Este problema permite que atacantes ignorem uma verificação de limites assinada por meio de uma sequência fundamental excessivamente longa. Ao fornecer um fluxo CCSDS 121.0/SZIP especialmente criado com 2^31 ou mais bits zero, um atacante pode causar a falha do decodificador ou vazar memória adjacente para amostras decodificadas.

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs decompress lzvn attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom read hdlr() and isom read dref entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine:: add annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

Kvazaar through 2.3.2 contains an infinite loop vulnerability in read header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs load extended attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

Existe uma leitura abaixo do limite de um byte no buffer de pilha na função `ini parse stream()` no arquivo `ini.c`. Isso ocorre quando um invasor fornece um arquivo ou string INI contendo uma linha de pelo menos `INI MAX LINE-1` bytes seguida por um byte NUL incorporado, permitindo a leitura de `abyss[-1]` e resultando em comportamento indefinido.

O descompressor MS-ZIP contém um problema de divulgação de memória não inicializada. Um invasor pode usar um arquivo MS-ZIP CAB especialmente criado onde o primeiro bloco começa com uma referência retroativa, levando a função `cabd->extract()` a gravar até 32 KiB de memória heap obsoleta na saída extraída. Isso permite o vazamento de dados do heap devido a distâncias de referência retroativa não verificadas.

Ocorre uma leitura fora dos limites quando o software processa pacotes com comprimentos de carga útil IP forjados. Atacantes não autenticados podem injetar pacotes TCP IPv4 ou IPv6 manipulados em tráfego capturado ou arquivos pcap, resultando no vazamento de memória de processo adjacente para arquivos de fluxo reconstruídos ou causando a falha do aplicativo.

Ocorre uma gravação fora dos limites do heap na função `af get page()`. Isso acontece quando imagens AFF manipuladas são fornecidas com tamanhos de página e setor incompatíveis, especificamente quando o tamanho da página é maior que e não é um múltiplo do tamanho do setor. Essa discrepância faz com que o loop de preenchimento de zeros do setor escreva além do buffer alocado, resultando na corrupção da memória heap e no travamento de ferramentas forenses.

Existe uma leitura fora dos limites da pilha na função `IMG LoadLBM IO()` em `src/IMG lbm.c`. O problema ocorre quando o modo HAM está ativado, pois o software não valida a contagem de bitplanes. Um invasor pode fornecer um arquivo ILBM especialmente criado com mais de 8 bitplanes HAM para ler além da matriz de pilha de colormap, causando travamentos do aplicativo ou a divulgação de memória da pilha.