Ada Logics

**Name of the Vulnerable Software and Affected Versions** iperf3 version 3.21 **Description** A remote, unauthenticated heap use-after-free exists in the server. The per-test watchdog function `server timer proc()` frees streams without cancelling or joining their worker threads, which can lead to a blocked worker dereferencing a freed `iperf stream`. A heap use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed. **Recommendations** Update iperf3 to version 3.22.

**Name of the Vulnerable Software and Affected Versions** iperf3 versions 3.20 through 3.21 **Description** A pre-authentication heap buffer overflow exists in the `decrypt rsa message()` function. This occurs because a 256-byte RSA buffer is read using a ciphertext length controlled by the attacker, allowing an unauthenticated client to overflow the heap by providing an oversized `authtoken`. **Recommendations** Update iperf3 to version 3.22.

**Name of the Vulnerable Software and Affected Versions** BookStack versions prior to 26.05.5 **Description** An authentication bypass exists in the social login implementation. Unauthenticated attackers can sign in as arbitrary users by authenticating through a social provider that shares the same `driver id` namespace as another provider. This occurs because the `handleLoginCallback()` function in `SocialAuthService` fails to include the driver column when querying linked account records, allowing a user ID from one provider to match an account linked to a different provider and bypass credential verification. **Recommendations** Update BookStack to version 26.05.5 or later.