Marcel Böhme

Certas implementações de tempo constante no wolfSSL podem ser alteradas por otimizações do LLVM, resultando em binários de tempo não constante. Essa transformação pode introduzir discrepâncias de temporização observáveis, potencialmente levando à divulgação de informações por meio de ataques de canal lateral de temporização.

A função da API pública BIO new NDEF é uma função auxiliar usada para transmitir dados ASN.1 por meio de um BIO. Ela é usada principalmente internamente no OpenSSL para oferecer suporte aos recursos de streaming SMIME, CMS e PKCS7, mas também pode ser chamada diretamente por aplicativos de usuários finais. A função recebe um BIO do chamador, acrescenta um novo filtro BIO f asn1 à sua frente para formar uma cadeia BIO e, em seguida, retorna o novo cabeçalho da cadeia BIO ao chamador. Sob certas condições, por exemplo, se uma chave pública do destinatário CMS for inválida, o novo filtro BIO é liberado e a função retorna um resultado NULL indicando uma falha. No entanto, nesse caso, a cadeia BIO não é limpa adequadamente e o BIO passado pelo chamador ainda retém ponteiros internos para o filtro BIO liberado anteriormente. Se o chamador então chamar BIO pop() no BIO, ocorrerá um uso após liberação. Isso provavelmente resultará em uma falha do sistema. Esse cenário ocorre diretamente na função interna B64 write ASN1(), o que pode fazer com que BIO new NDEF() seja chamado e, subsequentemente, chame BIO pop() no BIO. Outras funções da API pública que podem ser afetadas por isso incluem i2d ASN1 bio stream, BIO new CMS, BIO new PKCS7, i2d CMS bio stream e i2d PKCS7 bio stream.

The issue is related to improper maintenance of consistency between the context profile field and studio profile in libavcodec, which may trigger an assertion failure when converting a crafted AVI file to MPEG4. This can lead to a denial of service. The affected components include error resilience.c, h263dec.c, and mpeg4videodec.c. A remote attacker can exploit this issue using a specially crafted AVI file.

The issue is related to a missing check for failure of a call to `init get bits8()` in the `avpriv ac3 parse header` function in `libavcodec/ac3 parser.c`. This may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service. The vulnerability can be exploited by a remote attacker using a specially crafted AVI file, resulting in a denial of service.

The issue arises from an improper argument (`AVCodecParameters`) passed to the `avpriv request sample` function in the `handle eac3` function, potentially triggering an out-of-array read when converting a crafted AVI file to MPEG4. This could lead to a denial of service and possibly an information disclosure.

The issue arises from a missing check for negative values of the `mquant` variable in the `vc1 put blocks clamped` function, located in `libavcodec/vc1 block.c`. This can lead to an out-of-array access when converting a crafted AVI file to MPEG4, potentially resulting in information disclosure or a denial of service.

The issue is related to the `ff mpeg4 decode picture header` function in the `libavcodec/mpeg4videodec.c` component of the FFmpeg multimedia library. It is caused by a missing check of a profile value before setting it, which may trigger a NULL pointer dereference when converting a specially crafted AVI file to MPEG4. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker using a specially created AVI file.

The issue is related to the improper handling of frame types, other than EAC3 FRAME TYPE INDEPENDENT, that have multiple independent substreams in the handle eac3 function. This may trigger an out-of-array access while converting a crafted AVI file to MPEG4, potentially leading to a denial of service or allowing a remote attacker to execute arbitrary code using a specially crafted AVI file.

The issue is related to an improper integer type in the `mpeg4 encode gop header` function, which may cause an assertion violation when converting a crafted AVI file to MPEG4. This can lead to a denial of service.

The issue is related to a NULL pointer dereference in libavcodec when the studio profile is incorrectly detected while converting a crafted AVI file to MPEG4. This can lead to a denial of service. The problem is associated with the files idctdsp.c and mpegvideo.c.

The issue is related to an inconsistent bits-per-sample value in the `ff mpeg4 decode picture header` function, which may trigger an assertion violation when converting a crafted AVI file to MPEG4. This can lead to a denial of service. The vulnerability is caused by insufficient input validation, allowing a remote attacker to exploit it using a specially crafted AVI file.

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: An issue was discovered related to DSDiff input, where out-of-bounds writes can occur due to a lack of validation of unknown chunk sizes in the `ParseDsdiffHeaderConfig` function. This is caused by insufficient integer-overflow protection within a `bytes to copy` calculation and a subsequent `malloc` call, leading to insufficient memory allocation. Recommendations: For WavPack versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: An issue was discovered related to out-of-bounds writes due to insufficient validation of unknown chunk sizes in WAV input. This occurs because of a lack of integer-overflow protection within a bytes to copy calculation and subsequent malloc call, leading to insufficient memory allocation. Recommendations: For WavPack versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: An issue in the W64 parser component allows writing to memory. This is due to the `ParseWave64HeaderConfig` function in `wave64.c` not rejecting multiple format chunks. Recommendations: For versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: A issue in the WAV parser component allows writing to memory due to the `ParseRiffHeaderConfig` function in `riff.c` not rejecting multiple format chunks. Recommendations: For versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: An issue in WavPack for W64 input can cause out-of-bounds writes due to insufficient validation of unknown chunk sizes in the `ParseWave64HeaderConfig` function, located in `wave64.c`. This is related to a lack of integer-overflow protection within a `bytes to copy` calculation and a subsequent `malloc` call, leading to insufficient memory allocation. Recommendations: For WavPack versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a stack-based buffer overflow in the `xmlSnprintfElementContent` function in `valid.c`. This function is supposed to recursively dump the element content definition into a char buffer `buf` of size `size`. However, at the end of the routine, it may concatenate two more characters without checking whether the current `strlen(buf) + 2 < size`. This can cause programs that use libxml2, such as PHP, to crash. The vulnerability is associated with a buffer overflow in memory, which can be exploited by a remote attacker to cause a denial of service.

The Binary File Descriptor library is prone to an invalid read of size 4 due to NULL pointer dereferencing of ` bfd elf large com section`. This issue causes programs that analyze binary programs using the libbfd library, such as objcopy, to crash.

The Binary File Descriptor library is susceptible to an invalid read due to inadequate reloc offset range tests, which failed to account for small negative offsets. This issue can cause programs utilizing the library, such as objdump, to crash when analyzing binary programs.

The Binary File Descriptor library is prone to a global buffer over-read error due to an incorrect assumption about the naming of SHT REL/SHR RELA sections. This issue affects programs that analyze binary programs using the library, such as objcopy and strip, causing them to crash.