Chuan Wei

A heap-based buffer overflow exists in the MMS Protocol Workflow component within the `MmsMapping varAccessSpecToObjectReference()` function located in the `src/iec61850/common/iec61850 common.c` file. This issue occurs when the `GetNamedVariableListAttributesResponse.itemId` argument is manipulated, requiring local access to execute the attack.

A heap-based buffer overflow exists in the ASDU Element Handler component within the `SVReceiver stopThreadless()` function located in the `src/sampled values/sv subscriber.c` file. This issue allows a local attacker to trigger the overflow through specific manipulation.

A use after free issue exists in the URCB Revalidation component within the `deleteDataSetValuesShadowBuffer()` function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw allows for local manipulation of the system.

A heap-based buffer overflow occurs in the `UA Client readNodeClassAttribute()` function within the `src/client/ua client highlevel.c` file. This issue requires local access to be exploited.

A use after free issue exists in the `UA Client getRemoteDataTypes()` function within the examples/custom datatype/client types custom.c file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This issue can be exploited by a local attacker.

A remote out-of-bounds read can be triggered in the MMS Request Handler component. The issue resides in the `checkDataSetAccess()` function within the `src/iec61850/server/mms mapping/mms mapping.c` file.

A flaw in the Report Sending Path Handler allows a remote attacker to cause a memory error where memory not on the heap is freed. This occurs within the `Reporting RCBWriteAccessHandler()` function located in the src/iec61850/server/mms mapping/reporting.c file.

A security flaw allows for a remote out-of-bounds write, which occurs when the `PDULength` argument is manipulated within the `TSnap7Peer::NegotiatePDULength()` function located in the `src/core/s7 peer.cpp` file.

A remote attack can trigger an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer. This issue is located in the `CipAppPath::deserialize symbolic()` function within the source/src/cip/cipepath.cc file.

A remote issue exists in the Shared Client Library within the `responseReadNamespacesArray()` function located in the `src/client/ua client connect.c` file. Manipulation of the `Server NamespaceArray` argument can lead to a null pointer dereference, which occurs when a program attempts to read or write to a memory address that is null, typically resulting in a crash.

A flaw in the ReadVar Request Handler component allows for deserialization. The issue resides in the `TS7Worker::PerformFunctionRead()` function within the `src/core/s7 server.cpp` file. Exploitation of this issue requires the attacker to have access to the local network.

An out-of-bounds write can occur within the `BufWriter::append()` function of the EtherNet IP Message Handler component. This issue allows for remote exploitation through manipulation of the affected function.