Aviesrob

**Name of the Vulnerable Software and Affected Versions** SAMtools versions prior to 1.21.1 SAMtools versions prior to 1.22 **Description** SAMtools is a program used for bioinformatics file manipulation. The `mpileup` command, which outputs aligned DNA sequences, contains a flaw where data may be prematurely discarded from memory. This can lead to attempts to read from freed memory, potentially leaking program state or causing a crash. The issue occurs due to incorrect memory management within the `mpileup` command. **Recommendations** Update to SAMtools version 1.21.1 or later. Update to SAMtools version 1.22 or later.

**Name of the Vulnerable Software and Affected Versions** HTSlib versions 1.21.1 through 1.23.1 **Description** HTSlib is a library used for reading and writing bioinformatics file formats. A flaw exists in the CRAM decoder related to handling malformed sequence records. Specifically, the `CONST`, `XPACK`, and `XRLE` encodings do not correctly implement the necessary interface for handling records with omitted sequence or quality data. Attempting to decode these records results in a NULL pointer dereference, which typically causes the program to crash. **Recommendations** HTSlib version 1.23.1 includes a fix for this issue. HTSlib version 1.22.2 includes a fix for this issue. HTSlib version 1.21.1 includes a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** HTSlib versions 1.21.1 through 1.23.1 **Description** HTSlib is a library used for reading and writing bioinformatics file formats, specifically CRAM, a compressed format for DNA sequence alignment data. A flaw exists in the `cram decode slice()` function during CRAM record processing, where validation of the reference ID field occurs too late. This allows for two out-of-bounds read operations to potentially occur before the invalid data is detected. While the function reports an error, the leakage of two values to the caller may present an exploitation opportunity, or the program could crash due to invalid memory access. **Recommendations** HTSlib version 1.23.1 includes a fix for this issue. HTSlib version 1.22.2 includes a fix for this issue. HTSlib version 1.21.1 includes a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** HTSlib versions 1.21.1 through 1.23.1 **Description** HTSlib is a library used for handling bioinformatics file formats, specifically CRAM, a compressed format for DNA sequence alignment data. A flaw exists in how CRAM records are decoded, specifically within the `cram decode seq()` function. Insufficient validation of feature data series allows for potential leakage of arbitrary data, including program state information, or a program crash due to access of invalid memory locations. This occurs because the function can copy data from outside the bounds of the stored reference sequence into output buffers used for the CRAM record or the SAM `MD` tag. **Recommendations** HTSlib version 1.23.1 includes a fix for this issue. HTSlib version 1.22.2 includes a fix for this issue. HTSlib version 1.21.1 includes a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** HTSlib versions 1.21.1 through 1.23.1 **Description** HTSlib is a library used for handling bioinformatics file formats, specifically CRAM, a compressed DNA sequence alignment data format. A flaw exists in the `cram decode slice()` function during CRAM record processing where the mate reference ID field is not properly validated. This lack of validation can lead to out-of-bounds array reads when converting data to SAM format. If the resulting array value is a valid pointer, it may be interpreted as a string, potentially leading to information disclosure regarding program state or a program crash due to invalid memory access. **Recommendations** Update HTSlib to a version after 1.23.1.