Biniam

A remote out-of-bounds write can occur within the LECP CBOR Recording component. The issue resides in the `report raw cbor()` function located in the `lib/misc/lecp.c` file.

A flaw in the SSH Protocol Handler component allows for remote resource consumption. The issue exists within the `lws ssh parse plaintext()` function located in the `plugins/protocol lws ssh base/sshd.c` file. An attacker can trigger this by manipulating the `msg len` argument.

A flaw in the `doframe()` function within the src/core/debug.c file allows for an out-of-bounds read, which occurs when a specific manipulation is performed. This issue requires local access to be exploited.

An integer overflow can occur when executing a manipulation within the `unmarshal one fiber()` function located in the src/core/marsh.c file. This issue allows an attack to be launched on the local host.

A heap-based buffer overflow occurs in the Cnut File Handler component within the `ReadObject()` function of the `squirrel/sqobject.cpp` file. This issue allows a local attacker to perform a manipulation that leads to the overflow.

A stack-based buffer overflow occurs in the `validate format()` function within the `sqstdlib/sqstdstring.cpp` library. This issue allows a local attacker to execute a manipulation that leads to the overflow.

A heap-based buffer overflow occurs in the `SQFunctionProto::Load()` function within the `squirrel/sqobject.cpp` file. This issue allows for local execution to manipulate memory, potentially leading to a crash or arbitrary code execution. A heap-based buffer overflow is a condition where a program writes more data to a heap-allocated memory block than it can hold, overwriting adjacent memory.

A heap-based buffer overflow exists in the `SWSDfldsrch()` function within the `frmts/hdf4/hdf-eos/SWapi.c` file. This issue can be triggered through local access by executing a manipulation.

A heap-based buffer overflow exists in the Grid File Handler component. This issue occurs within the `GDSDfldsrch()` function located in the `frmts/hdf4/hdf-eos/GDapi.c` file. Exploitation requires local access to the system.

A weakness in the `GDfieldinfo()` function within the `frmts/hdf4/hdf-eos/GDapi.c` file can lead to an out-of-bounds read, which occurs when a program reads data past the end of the intended buffer. This issue requires the attack to be launched locally.

An issue exists in the HDF-EOS Grid File Handler component within the `memmove()` function of the `frmts/hdf4/hdf-eos/SWapi.c` file. This flaw allows for an out-of-bounds read, which occurs when the system reads data outside the intended boundary of a buffer. This attack is restricted to local execution.

A heap-based buffer overflow occurs in the `SWnentries()` function within the `frmts/hdf4/hdf-eos/SWapi.c` file. This issue is triggered by the manipulation of the `DimensionName` argument and requires local access to be exploited.

A heap-based buffer overflow occurs in the `GDnentries()` function within the `frmts/hdf4/hdf-eos/GDapi.c` file. This issue is triggered by manipulating the `DataFieldName` argument and requires the attack to be initiated from a local position.

An out-of-bounds write issue exists within the DDS Image Handler component, specifically affecting the `src/dds.imageio/ddsinput.cpp` file. This flaw requires local access to be exploited.

An out-of-bounds read exists in the CFF Index Handler component within the `fz subset cff for gids()` function of the `subset-cff.c` file. This issue allows for local execution of the attack.

A heap-based buffer overflow exists in the nip2 Handler component within the `im minpos vec()` function of the file libvips/deprecated/vips7compat.c. This issue occurs when the argument `n` is manipulated, allowing for a memory corruption. Exploitation requires local access.

Name of the Vulnerable Software and Affected Versions LibRaw versions up to 0.22.0 Description A flaw exists in LibRaw up to version 0.22.0 within the `LibRaw::nikon load padded packed raw` function located in the `src/decoders/decoders libraw.cpp` file, related to the TIFF/NEF component. Manipulation of the `load flags`/`raw width` arguments can result in an out-of-bounds read. Remote exploitation is possible. Recommendations Upgrade to version 0.22.1 or later.

Name of the Vulnerable Software and Affected Versions LibRaw versions up to 0.22.0 Description A weakness exists in LibRaw, specifically in the `HuffTable::initval` function within the `src/decompressors/losslessjpeg.cpp` file of the JPEG DHT Parser component. This allows for an out-of-bounds write due to manipulation of the `bits[]` argument. The attack can be initiated remotely and an exploit is publicly available. Recommendations Upgrade to version 0.22.1 or later to address this issue.

A heap-based buffer overflow exists in the `do pnm2png` function within the `pnm2png.c` file of the `pnm2png` component. The issue is triggered by manipulating the `width` and `height` arguments. Exploitation is restricted to local execution, and an exploit has been published. The project was notified of the issue but has not yet responded.

A flaw exists in strukturag libheif that allows for an out-of-bounds read. The issue resides in the `vvdec push data2` function within the `libheif/plugins/decoder vvdec.cc` file of the HEIF File Parser component. Manipulating the `size` argument can trigger the flaw. The attack requires local access. The exploit has been publicly disclosed.