Bas Alberts

**Name of the Vulnerable Software and Affected Versions** Emacs TRAMP (affected versions not specified) Red Hat Enterprise Linux (affected versions not specified) **Description** A flaw in Emacs TRAMP allows a local attacker to execute arbitrary code by processing maliciously crafted filenames. The issue arises because TRAMP concatenates login arguments without proper sanitization before passing them to a local shell. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: png-img versions prior to 3.1.0 Description: The issue is caused by an integer overflow in the PngImg::InitStorage () function, leading to under-allocation of heap memory. This results in a heap-based buffer overflow when a crafted PNG file is loaded. Recommendations: For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the PngImg::InitStorage () function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** nDPI versions 3.2 Stable and earlier **Description** The SSH protocol dissector in nDPI has multiple KEXINIT integer overflows, resulting in a controlled remote heap overflow in `concat hash string` in `ssh.c`. This issue can be exploited to achieve full Remote Code Execution against any network inspection stack linked against nDPI that uses it for network traffic analysis. **Recommendations** For nDPI versions 3.2 Stable and earlier, consider disabling the SSH protocol dissector as a temporary workaround until a patch is available. Restrict access to the `ssh.c` module to minimize the risk of exploitation. Avoid using the `concat hash string` function in the affected SSH protocol dissector until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** nDPI versions 3.2 Stable and earlier **Description** The issue allows a network-positioned attacker to exploit an out-of-bounds read in `concat hash string` in `ssh.c` by sending malformed SSH protocol messages on a network segment monitored by nDPI's library. **Recommendations** For nDPI versions 3.2 Stable and earlier, consider restricting access to the `ssh.c` module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the `concat hash string` function in the affected `ssh.c` file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.