Alan Coopersmith

An issue in the decompression logic of zlib-compressed network messages allows an unauthenticated remote attacker to read uninitialized heap memory. The flaw occurs because the server incorrectly handles length parameters in protocol headers, returning the size of the allocated memory buffer instead of the actual length of the decompressed data. By sending specially crafted malformed packets, an attacker can extract sensitive information from the server's memory, such as plaintext database passwords, API keys, session tokens, and cloud service credentials. Approximately 87,000 internet-exposed MongoDB servers are estimated to be potentially vulnerable, with 42% of cloud environments containing at least one affected instance. This issue has been actively exploited in the wild, including a reported breach of Ubisoft's Rainbow Six Siege services to manipulate in-game data and potentially access internal source code.

The vulnerability is related to a buffer over-read in PostgreSQL's GB18030 encoding validation. This issue allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. The vulnerability affects the database server and also libpq. An attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service.

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.82.1 Description: The issue is related to an off-by-one error and resultant buffer overflow in the `gio/gsocks4aproxy.c` component of GNOME GLib. This occurs because `SOCKS4 CONN MSG LEN` is not sufficient for a trailing `0` character. The vulnerability is associated with uncontrolled copying of input data, which could allow a remote attacker to cause a denial of service. Despite being marked as critical, exploitation of this issue in real-world scenarios is considered highly unlikely. Recommendations: For GNOME GLib versions prior to 2.82.1, update to version 2.82.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `gio/gsocks4aproxy.c` component until a patch is applied. Avoid using the `SOCKS4 CONN MSG LEN` variable in affected API endpoints until the issue is resolved.

The issue is related to regular expressions used in tarfile.TarFile header parsing, which can cause excessive backtracking and are vulnerable to ReDoS via specifically-crafted tar archives. This can lead to a denial of service. The vulnerability is associated with incorrect syntax analysis of the file header.

The issue is related to hardware logic with insecure de-synchronization in Intel DSA and Intel IAA, which may allow an authorized user to potentially enable escalation of privilege or denial of service via local access.

A heap-based buffer over-read issue was found in the X.org server's `ProcAppleDRICreatePixmap()` function. This occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, especially when triggered by a client with different endianness. An attacker could exploit this to cause the X server to read heap memory values and transmit them back to the client until encountering an unmapped page, resulting in a crash. Although the attacker cannot control the specific memory copied into the replies, small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. This could allow an attacker to access confidential data, compromise their integrity, and cause a denial of service.

The issue allows an attacker to cause a denial of service, specifically memory consumption, via a window resize escape sequence. This is related to a historical issue.

The issue is related to a use-after-free vulnerability in the `xmlUnlinkNode` function, located in `tree.c`, which can occur after a certain memory allocation fails. This could potentially allow a remote attacker to cause a denial of service. The vendor has stated that they do not consider this issue critical enough to warrant a fix because an attacker typically cannot control when memory allocations fail.

A security flaw was found in libX11 due to functions in src/InitExt.c not checking if the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to. This can lead to memory corruption, potentially causing the client to crash, if a malicious server or proxy-in-the-middle provides out-of-bounds values. The issue is related to buffer overflows in InitExt.c.

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the `PATH` environment variable. This could potentially allow an attacker to execute arbitrary code with elevated privileges.

The issue is related to the `cr parser parse any core` function in the `cr-parser.c` component of the libcroco library, which is used for working with cascading style sheets (css2). It is associated with uncontrolled recursion. Exploitation of this issue may allow a remote attacker to compromise data integrity and cause a denial of service.

The issue is related to an integer overflow in the `ProcDbeGetVisualInfo` function, which could allow a malicious X client to cause the X server to crash or possibly execute arbitrary code.

The issue is related to the `bdfReadCharacters` function in `bitmap/bdfread.c`, which does not properly perform type conversion for metrics values. This allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.

The issue is related to a stack-based buffer overflow in the `bdfReadCharacters` function, which can be triggered by a long string in a character name in a BDF font file. This can cause a denial of service (crash) or possibly allow remote attackers to execute arbitrary code. Multiple vulnerabilities in the libXfont package can lead to violations of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.