Hongxuchen

O problema está relacionado a uma vulnerabilidade do tipo “use-after-free” na função `libpff item tree create node`, que permite que invasores causem uma negação de serviço ou executem código arbitrário por meio de um arquivo pff malicioso. Essa vulnerabilidade também pode levar ao acesso não autorizado a dados confidenciais e à violação da integridade dos dados.

**Nome do software vulnerável e versões afetadas: Cesanta MJS versão 1.20.1 Descrição: O problema é uma vulnerabilidade de estouro de pilha na função `parse array`, que permite que invasores remotos provoquem uma negação de serviço (DoS) por meio de um arquivo malicioso. Recomendações: Para o Cesanta MJS versão 1.20.1, como solução temporária, considere desativar a função `parse array` até que um patch esteja disponível. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas: Cesanta MJS versão 1.20.1 Descrição: O problema é uma vulnerabilidade de estouro de pilha na função `parse value`, que permite que invasores remotos provoquem uma negação de serviço (DoS) por meio de um arquivo malicioso. Recomendações: Para o Cesanta MJS versão 1.20.1, como solução temporária, considere desativar a função `parse value` até que um patch esteja disponível. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

O problema está relacionado a um estouro de buffer de pilha na função `gif process raster` no arquivo `fromgif.c`, que pode ser explorado por um invasor remoto para causar uma negação de serviço.

A vulnerabilidade no componente dither.c da libsixel permite que invasores provoquem uma negação de serviço por meio de um arquivo PNG malicioso. Isso está relacionado a erros na liberação de recursos. A exploração da vulnerabilidade permite que um invasor remoto provoque uma negação de serviço usando um arquivo PNG especialmente criado.

The issue is related to a use-after-free error in the `coders/mat.c` function of the ImageMagick console graphic editor. This error can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability can be triggered by crafting a malicious Matlab image file that is mishandled in `ReadImage` in `MagickCore/constitute.c`, leading to an application crash.

The issue allows attackers to cause a denial-of-service, resulting in an application crash due to a heap-based buffer over-read, via a crafted TIFF image file. This is related to functions in LibTIFF, specifically `TIFFRewriteDirectory`, `TIFFWriteDirectory`, `TIFFWriteDirectorySec`, and `TIFFWriteDirectoryTagColormap` in tif dirwrite.c. The problem occurs because of an incomplete fix for a previous issue.

The issue is related to the XWD image parsing component in ImageMagick, which allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) by crafting a corrupted XWD image file. This can be exploited by a remote attacker to cause a service disruption.

The issue is related to an out-of-bounds write in the OpenMP4Source function located in the demo/GPMF mp4reader.c file.

The issue is related to an out-of-bounds read and a segmentation fault (SEGV) in the GPMF Next function within the GPMF parser.c file.

The issue is related to a heap-based buffer over-read in the GPMF Next function located in GPMF parser.c. This over-read is 4 bytes in size.

Name of the Vulnerable Software and Affected Versions: Dropbox Lepton version 1.2.1 Description: The issue is related to a missing check of header payloads in the decompression component, specifically in the io/ZlibCompression.cc file. This allows attackers to craft a jpg image file that can cause a denial of service, resulting in a heap-based buffer overflow and application crash, or possibly have other unspecified impacts. Recommendations: For version 1.2.1, update to a newer version that includes a fix for the missing check of header payloads in the decompression component to prevent the heap-based buffer overflow and application crash.

Name of the Vulnerable Software and Affected Versions: LibSass versions 3.5.5 and earlier Description: The parsing component in LibSass allows attackers to cause a denial-of-service due to uncontrolled recursion in `Sass::Parser::parse css variable value` in parser.cpp. Recommendations: For LibSass versions 3.5.5 and earlier, consider updating to a version later than 3.5.5 to resolve the issue. As a temporary workaround, consider restricting the input to the `parse css variable value` function to minimize the risk of uncontrolled recursion.

The issue is related to the Cineon parsing component, which allows attackers to cause a denial-of-service due to uncontrolled resource consumption. This can be achieved by creating a Cineon image with an incorrect claimed image size. The problem stems from the `ReadCINImage` function in `coders/cin.c`, which lacks sufficient checks for image data in a file. An attacker can exploit this by crafting a Cineon image that exceeds the standard size, leading to a denial-of-service.

Name of the Vulnerable Software and Affected Versions: Dropbox Lepton version 1.2.1 Description: The issue allows attackers to cause a denial-of-service, resulting in an application runtime crash due to an integer overflow, by providing a crafted file. Recommendations: For Dropbox Lepton version 1.2.1, update to a newer version that contains a fix for this issue to prevent potential crashes caused by crafted files.

The issue is related to a denial-of-service (divide-by-zero error) in the XWD image parsing component of ImageMagick. This can be triggered by crafting a specific XWD image file where the header does not indicate whether the data is stored in least significant bit (LSB) first or most significant bit (MSB) first order. An attacker could exploit this vulnerability to cause a denial-of-service.

Name of the Vulnerable Software and Affected Versions: LibSass version 3.5.4 Description: The issue allows attackers to cause a denial-of-service due to uncontrolled recursion. This occurs in the `Sass::Complex Selector::perform` function in `ast.hpp` and the `Sass::Inspect::operator` in `inspect.cpp`. Recommendations: For LibSass version 3.5.4, consider disabling the `Sass::Complex Selector::perform` function and the `Sass::Inspect::operator` as a temporary workaround until a patch is available. Restrict access to the affected modules to minimize the risk of exploitation.

The issue is related to a use-after-free error in the `heif::HeifContext::Image::set alpha channel` function, located in `heif context.h`, due to mishandling of references to non-existing alpha images in `heif context.cc`.

The issue is a stack-based buffer overflow in the scan file function in mxmldoc.c.

The issue is related to a use-after-free in the `mxmlAdd` function of the `mxml-node.c` file. This could allow remote attackers to cause a denial-of-service via a crafted XML file.