Anthropic

Improper validation of RunEndEncoded arrays in the ArrayData interface allows reading data beyond the bounds of the child values array. This occurs during the validation of RunEndEncoded arrays via the `ArrayData::validate values` function, which can lead to an out-of-bounds read when accessing the last value through APIs such as `TypedRunArray::value`.

Postiz fails to verify that media paths not formatted as web addresses are located within the designated upload directory. This allows a registered user to provide a crafted media path that enables the publishing worker to read arbitrary files from the server's disk and send them as attachments to an external Discord server. Additionally, two other routes allow for similar unconfined reads: one that confirms file existence and can lead to backend memory exhaustion, and another that delivers the file. Since self-registration is enabled by default, an attacker can create an account to exploit these issues.

Postiz uses a single shared secret to sign session, invitation, and password reset tokens without including a marker to distinguish the token purpose. A route used to refresh browser-extension channel credentials signs data provided in the request and stores the result for the user to retrieve. This allows a user to forge a validly signed token with arbitrary claims, which the application may accept as a session token, an organization invitation with a specific role, a password reset token, or an enterprise provisioning token. Additionally, a route for creating team invitations signs extra fields from the request body using the same flawed mechanism.

Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper functions not intended for web interface access. One such helper enables the reading of arbitrary files from the server disk if a channel is connected using a file path as a token, potentially exposing environment variables, session signing secrets, database addresses, and service credentials. Additionally, another helper function can be used to force the backend process to exit, causing a denial of service. Since self-registration is enabled by default, these actions can be performed by any newly registered user.

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside its assigned regions. This occurs via a buffer argument passed to an MPU system call.

Numeric truncation of the buffer length occurs during the MPU buffer authorization check on the Arm Cortex-R82 (Armv8-R AArch64) MPU port. This issue may allow an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window through a stream buffer system call.

When built with GnuTLS, a malicious WebSocket server can cause curl to send memory beyond its send buffer. This occurs because of an out-of-bounds read that happens when the `gnutls record send()` function returns a number of bytes sent that exceeds the number of bytes it was originally instructed to send, typically following a blocked send.

A heap-based buffer overflow write exists in the read-only dictionary loader. The `String::reserve()` function in `common/string.hpp` performs a capacity check using a signed integer `((int)s + 1)`, which allows a requested size of `0x7FFFFFFF` to wrap to a negative value, preventing the backing buffer from growing. The `ReadOnlyDict::load()` function in `modules/speller/default/readonly ws.cpp` passes unvalidated 32-bit size fields from a `.rws` dictionary header into this path. Consequently, a crafted `.rws` file containing a valid endian marker and an oversized length field, such as `lang name size` set to `0x7FFFFFFF`, allows attacker-controlled data to be written out of bounds past an undersized heap allocation. This can lead to heap memory corruption, resulting in denial of service or potential code execution if a victim is induced to load a malicious dictionary.

A remote, unauthenticated heap use-after-free exists in the server. The per-test watchdog function `server timer proc()` frees streams without cancelling or joining their worker threads, which can lead to a blocked worker dereferencing a freed `iperf stream`. A heap use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed.

A pre-authentication heap buffer overflow exists in the `decrypt rsa message()` function. This occurs because a 256-byte RSA buffer is read using a ciphertext length controlled by the attacker, allowing an unauthenticated client to overflow the heap by providing an oversized `authtoken`.

An improper exposure of resource to the wrong sphere exists in the host file helper (gofer) on Linux platforms with CUSE (Character device for Userspace) enabled. A local attacker with container image deployment privileges can achieve root code execution on the host system by including a `/dev/cuse` character device node in a container image. Opening this device allows the sandboxed attacker to register a host device and exploit unrestricted ioctl (input/output control) handling to overwrite root udev helper memory.

A use-after-free memory corruption issue exists during HTTP/2 uploads. The flaw occurs when curl mishandles an HTTP/2 `RST STREAM` response received from a server with the reason `HTTP 1 1 REQUIRED` or `REFUSED STREAM`, leading to a use-after-free of a `struct Curl easy` object. A remote attacker controlling a malicious server can exploit this to cause a client crash or, under highly specific conditions involving precise knowledge of the target's architecture, memory layout, and TLS configuration, achieve remote code execution.

A heap buffer overflow occurs during the import of drawings in DXF format used by CAD software. The issue arises when importing a DXF polyline because the point count is truncated to a 16-bit value during buffer sizing, while the full count is used to fill the buffer. Consequently, polylines with a point count exceeding the 16-bit range are written past the end of the buffer.

A heap use-after-free occurs during the import of blank-width characters within an ODF number format. This happens because a position value read from the document is not validated against the length of the format-code string, allowing a malformed number format to be processed against memory outside the intended string boundaries. Heap use-after-free is a memory corruption issue where a program continues to use a pointer after the memory it points to has been freed.

A heap buffer overflow occurs during the import of EMF+ graphics, which can be embedded in documents. Specifically, the issue arises when importing an EMF+ gradient brush. The software reads the number of gradient blend points from the file to calculate the allocation size; however, this multiplication can overflow. This results in the allocation of a buffer that is too small, which is then filled as if it were larger, leading to data being written past the end of the buffer.

A heap buffer overflow occurs during the import of documents in the OOXML (DOCX) format. The issue arises when replaying deferred parser events for a text box element, where a handler object is assumed to be of a specific type and written to according to that type's field layout. If the object is smaller than assumed, the write operation extends beyond the end of the memory allocation.

A stack buffer overflow occurs when importing presentations in the legacy binary PPT format. The issue arises during the import of a colour-replacement record where two fixed-size colour tables are filled from the file. Because the write position is not reset between the two passes over the record, a file with combined colour counts exceeding the table size writes past the end of the tables on the stack.

A heap buffer overflow occurs during the compilation of cell formulas when opening a spreadsheet. This issue is triggered by very long formulas containing numerous opening tokens. The array used to track nesting depth is allocated with one element too few for the worst-case scenario, causing the formula to write one element beyond the array boundary.

A heap buffer overflow occurs during the import of tracked changes from a spreadsheet document. This happens when a document reuses the same change identifier for two different types of changes, causing the importer to treat a change object as a larger type and write data beyond the allocated memory boundary.

An out-of-bounds write issue exists in the virtio PCI transport on x86 64 and aarch64 architectures. A local guest user with root privileges can exploit this by modifying virtio queue configuration registers after device activation to crash the Firecracker VMM process or potentially execute arbitrary code on the host. Host code execution requires additional preconditions, such as specific snapshot configurations or the use of a custom guest kernel.