Bas Alberts

A flaw in Emacs TRAMP allows a local attacker to execute arbitrary code by processing maliciously crafted filenames. The issue arises because TRAMP concatenates login arguments without proper sanitization before passing them to a local shell.

Name of the Vulnerable Software and Affected Versions: png-img versions prior to 3.1.0 Description: The issue is caused by an integer overflow in the PngImg::InitStorage () function, leading to under-allocation of heap memory. This results in a heap-based buffer overflow when a crafted PNG file is loaded. Recommendations: For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the PngImg::InitStorage () function until a patch is available.

The SSH protocol dissector in nDPI has multiple KEXINIT integer overflows, resulting in a controlled remote heap overflow in `concat hash string` in `ssh.c`. This issue can be exploited to achieve full Remote Code Execution against any network inspection stack linked against nDPI that uses it for network traffic analysis.

The issue allows a network-positioned attacker to exploit an out-of-bounds read in `concat hash string` in `ssh.c` by sending malformed SSH protocol messages on a network segment monitored by nDPI's library.