Laurent Butti

The issue exists in the BSSGP dissector due to incorrect handling of global variables. This allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted packet.

The issue is related to multiple buffer overflows in the create ntlmssp v2 key function in the NTLMSSP v2 dissector. This can be exploited by remote attackers to cause a denial of service, specifically an application crash, by sending a packet with a long domain name.

The issue allows remote attackers to cause a denial of service or possibly have other impacts via crafted JPEG2000 data in the libavcodec/jpeg2000.c file.

The issue is related to the av reallocp array function in libavutil/mem.c, which has an unspecified impact and remote vectors related to a "wrong return code" and a resultant NULL pointer dereference.

The issue is related to the Bluetooth HCI ACL dissector, which does not properly maintain a certain free list. This allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted packet that is not properly handled by the `wmem block alloc` function in `epan/wmem/wmem allocator block.c`.

The issue is related to a buffer overflow in the mp4a packetizer, which can be exploited by remote attackers to cause a denial of service or possibly execute arbitrary code. The buffer overflow occurs in the dynamic memory of the mp4a packetizer.

The issue is related to a double free vulnerability in the dissect dcom ActivationProperties function in the DCOM ISystemActivator dissector. This vulnerability allows remote attackers to cause a denial of service, resulting in an application crash, by sending a crafted packet.

The issue is caused by an off-by-one error in the dissect radiotap function in the Radiotap dissector. This error allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted packet.

The issue is related to the RDP dissector in Wireshark, where it fails to validate return values during checks for data availability. This can be exploited by remote attackers to cause a denial of service, resulting in an application crash, via a crafted packet.

The issue is related to the dissect capwap data function in the CAPWAP dissector, which incorrectly handles a -1 data value to represent an error condition. This allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted packet.

The issue is related to the dissect dvbci tpdu hdr function in the DVB-CI dissector, which does not validate a certain length value before decrementing it. This allows remote attackers to cause a denial of service, resulting in an assertion failure and application exit, via a crafted packet.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, by providing invalid Sub-tlv data to the dissect mpls echo tlv dd map function in the MPLS Echo dissector.

The issue exists in the `fragment set tot len` function in `epan/reassemble.c` due to incorrect determination of the length of a reassembled packet for the DTLS dissector. This allows remote attackers to cause a denial of service (application crash) via a malformed packet.

The issue exists in the `dissect pw eth heuristic` function due to incorrect handling of apparent Ethernet address values at the beginning of MPLS data. This allows remote attackers to cause a denial of service (loop) via a malformed packet.

The issue is related to the dissect bthci eir ad data function in the Bluetooth HCI dissector, which uses an incorrect data type for a counter variable. This allows remote attackers to cause a denial of service, resulting in an infinite loop, via a malformed packet.

The issue arises from the `csnStreamDissector` function in the CSN.1 dissector, which fails to properly handle a large number of padding bits. This allows remote attackers to cause a denial of service, resulting in an infinite loop, by sending a malformed packet.

The issue exists in the `rtps util add bitmap` function due to incorrect implementation of nested loops for processing bitmap data. This allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.

The issue exists in the epan/tvbuff.c file of Wireshark due to incorrect validation of length values for the MS-MMC dissector. This allows remote attackers to cause a denial of service, resulting in an application crash, via a malformed packet.

The issue is related to a buffer overflow in the dissect tlv function in the LDP dissector. This can be exploited by remote attackers via a malformed packet, potentially causing a denial of service or other unspecified impacts.

A buffer overflow issue exists in the dissect gsm rlcmac downlink function in the GSM RLC MAC dissector, allowing remote attackers to execute arbitrary code via a malformed packet.