Cla7Aye15I4Nd

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** An invalid out-of-bounds memory read exists in the protected internal `Node#initialize copy with args` helper, which is utilized by `Node#dup` and `#clone`. The issue occurs because the helper unwraps its source argument as an xmlNode without performing a type check. If the method is called with a non-Node argument, such as a Namespace, the process reads an xmlNs out of bounds, leading to a crash. This issue is specific to CRuby and is only triggerable via a programming error, as it cannot be exploited through untrusted input or standard use of the public API. **Recommendations** Update Nokogiri to version 1.19.4 or later.

**Name of the Vulnerable Software and Affected Versions** luci-lib-px5g versions 18.06 through 25.12 **Description** A heap-based buffer overflow exists in the native ASN.1 encoding routine `asn1 add obj()` within `x509write.c` when signing a certificate using a 2040-bit RSA key. The issue occurs because the BIT STRING allocation is calculated based on the DER length encoding of 255 bytes, but the actual payload written, including the unused-bits byte, is 256 bytes. This requires an additional DER length octet, resulting in an allocation of 259 bytes while 260 bytes are required. Consequently, the final `memcpy()` operation writes one byte beyond the heap buffer. This flaw is accessible through the exported Lua interface via the `create selfsigned()` function. **Recommendations** As a temporary workaround, restrict the use of the `create selfsigned()` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** In the CRuby (libxml2) implementation, calling the `Document#encoding=` method with an invalid encoding, such as a non-string or a string containing a null byte, triggers an exception. This process occurs after the current encoding string of the document is freed without being replaced, leaving the document referencing freed memory. Consequently, subsequent calls to `Document#encoding` read invalid memory, which may lead to a segmentation fault (a crash occurring when a program attempts to access a memory location it is not allowed to access) or the leakage of freed bytes into a Ruby String. **Recommendations** Update to version 1.19.4. As a temporary mitigation, avoid passing non-string values or strings containing null bytes to the `Document#encoding=` method.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** Nokogiri contains a bug occurring when certain methods are called on native wrapper classes that inherit from `Nokogiri::XML::Node` and have been allocated but not initialized. This leads to a NULL pointer dereference, which is a condition where the software attempts to read from a memory address that is null, resulting in a process crash. **Recommendations** Update to version 1.19.4.

**Name of the Vulnerable Software and Affected Versions** Oj versions prior to 3.17.2 **Description** `Oj.dump` is subject to a stack-based buffer overflow when a large `:indent` value is provided. The `fill indent()` function in `dump.h` utilizes `memset()` to fill a buffer without validating the size of the `indent` option. If `opts->indent` is set to `INT MAX` (2,147,483,647), the process writes approximately 2 GB into a stack-allocated buffer of 4,184 bytes, leading to stack corruption and a process crash. **Recommendations** Update to version 3.17.2. As a temporary workaround, avoid using extreme values for the `:indent` parameter and do not allow users to specify unlimited indentation sizes when dumping Ruby data.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** In the Nokogiri XML and HTML library for Ruby, the `Nokogiri::XML::XPathContext` does not maintain a reference to its source document to prevent garbage collection. If an `XPathContext` persists after its associated document has been collected by the garbage collector, evaluating an XPath expression may result in reading invalid memory, potentially leading to a segmentation fault (segfault), which is a crash caused by accessing memory that the program is not allowed to access. This issue occurs only when application code directly instantiates an `XPathContext` and allows the document to become unreachable while the context is still in use. Standard search methods such as `Document#xpath` and `Document#css` are not affected, and the issue cannot be triggered via malicious document input. **Recommendations** Update to version 1.19.4.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** An issue exists in the XInclude substitution process where the `do xinclude()` function in `Nokogiri::XML::Node` replaces each `<xi:include>` element in place. This process frees the include node, its children (such as `<xi:fallback>` and its descendants), and any associated namespaces. If an application has already exposed these nodes or namespaces to Ruby, the resulting Ruby object points to freed memory, which can lead to invalid memory reads or writes. **Recommendations** Update to version 1.19.4.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** The CRuby native extension of this XML and HTML library can leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code has already accessed an attribute child node, the `Nokogiri::XML::Attr#value=` function could free the underlying native child node while the wrapper remains reachable through the document node cache. Subsequent use of the freed child node or a Ruby GC mark may dereference an invalid pointer, leading to an invalid read and a potential segfault (a specific type of crash caused by accessing memory that the program does not have permission to access). **Recommendations** Update to version 1.19.4.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** Nokogiri is an open source XML and HTML library for the Ruby programming language. The `Nokogiri::XML::NodeSet#[]` function (and its alias `slice`) performs a bounds check on the requested index using a 32-bit-truncated copy. A large negative index can bypass this check and be used at full width, resulting in reading outside the node set's storage. In CRuby, this leads to an out-of-bounds read that typically crashes the process, while in JRuby, it results in the return of an incorrect node. **Recommendations** Update Nokogiri to version 1.19.4.