Sergej Schumilo

Foi detectado um estouro de pilha por meio de uma vulnerabilidade de recursão infinita no emulador de dispositivo eepro100 i8255x do QEMU. Esse problema ocorre durante o processamento de comandos do controlador devido a uma falha de reentrada de DMA. A falha permite que um usuário ou processo convidado consuma ciclos de CPU ou cause a falha do processo do QEMU no host, resultando em uma negação de serviço. A maior ameaça dessa vulnerabilidade é à disponibilidade do sistema.

Foi detectada uma falha de loop infinito no emulador de placa de rede e1000 do QEMU. Esse problema ocorre durante o processamento de descritores de transmissão (tx) na função `process tx desc`, caso vários campos do descritor sejam inicializados com valores inválidos. Essa falha permite que um convidado consuma ciclos de CPU no host, resultando em uma negação de serviço. A maior ameaça dessa vulnerabilidade é à disponibilidade do sistema.

O problema está relacionado a uma desreferência de ponteiro NULL na função `pci change irq level` em `hw/pci/pci.c`. Isso ocorre porque `pci get bus()` pode não retornar um ponteiro válido, permitindo potencialmente que um invasor cause uma negação de serviço.

The issue is related to a NULL pointer dereference in the `interface release resource` function in `hw/display/qxl.c`. This could potentially allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not specified.

An issue in datafile.c allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in `df generate ascii array entry()`. This can be exploited by passing an overlong string as the right bound of the range argument to the `plot()` function.

A buffer overflow issue exists due to a missing size check of an argument passed to the `set font` function, specifically in the `cairotrm options` function when the Gnuplot pngcairo terminal is used as a backend. This allows an attacker to conduct a buffer overflow with an arbitrary amount of data.

An issue in Gnuplot allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the `PS options` function. This flaw is caused by a missing size check of an argument passed to the `set font` function. The issue occurs when the Gnuplot postscript terminal is used as a backend.

The issue concerns a signed integer overflow in the CHECK macro within the mrbgems/mruby-sprintf/src/sprintf.c file of mruby. This overflow could potentially lead to out-of-bounds memory access due to the mrb str resize function in string.c not checking for negative lengths.

The issue is related to the ntfs end buffer async read function in the ntfs.ko filesystem driver, which allows attackers to trigger a stack-based out-of-bounds write. This can cause a denial of service, resulting in a kernel oops or panic, and may have other unspecified impacts. The attack can be initiated via a crafted ntfs filesystem.

A NULL pointer dereference issue was found in the hfs ext read extent function within the hfs.ko module. This issue can be triggered when mounting a specially crafted hfs filesystem.

The issue is related to the ntfs read locked inode function in the ntfs.ko filesystem driver, which allows attackers to trigger a use-after-free read. This could potentially cause a denial of service, resulting in a kernel oops or panic, via a crafted ntfs filesystem.

The issue is related to the ntfs attr find function in the ntfs.ko filesystem driver, which allows attackers to trigger a stack-based out-of-bounds write. This can cause a denial of service, resulting in a kernel oops or panic, and may have other unspecified impacts. The attack is possible via a crafted ntfs filesystem.

An issue was discovered in the arm pt function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils. This issue leads to stack exhaustion in the C++ demangling functions provided by libiberty. The functions involved include demangle arm hp template, demangle class name, demangle fund type, do type, do arg, demangle args, and demangle nested args. This can occur during the execution of nm-new.

A memory leak was found in the formatIPTCfromBuffer function in coders/meta.c.

The issue is related to a null pointer dereference in the ReadOneJNGImage function of the coders/png.c component. This can be exploited by a remote attacker to cause a denial of service, resulting in a WriteBlob assertion failure and application exit, via a crafted file.

The issue is related to a NULL pointer dereference error in the `work stuff copy to from` function of the `cplus-dem.c` component. This error can be exploited by a remote attacker to cause a denial of service. The vulnerability can occur during the execution of `objdump`.

The issue is related to a buffer overflow in the HFS component of the Mac OS X operating system. This can be exploited by a remote attacker using a specially crafted application, potentially allowing them to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption.

The issue involves the `APFS` component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This is caused by a buffer overflow in memory, which can be exploited by a remote attacker to achieve the aforementioned outcomes.

The issue allows physically proximate attackers to cause a denial of service, resulting in a NULL pointer dereference and system crash, via a crafted USB device without two interrupt-in endpoint descriptors. This is due to a problem in the `mct u232 msr to state` function.

The issue allows physically proximate attackers to cause a denial of service, resulting in a NULL pointer dereference and system crash. This is achieved via a crafted `endpoints` value in a USB device descriptor, specifically targeting the `digi port init` function in the Linux kernel.