D7Ead

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions 3.0.0 through 3.31.0 **Description** An integer truncation issue exists in the `license check stream length()` function. A malicious RDP server can exploit this by sending a crafted SERVER LICENSE REQUEST containing a large `scopeCount` value. This bypasses length checks and triggers a heap buffer overflow on 32-bit clients, resulting in out-of-bounds writes that may lead to denial of service or remote code execution. **Recommendations** Update FreeRDP to version 3.32.0 or later.

**Name of the Vulnerable Software and Affected Versions** NetX Duo SNMP addon (affected versions not specified) **Description** The ` nx snmp utility object id get` function in the NetX Duo SNMP addon fails to validate the claimed OID data length against the actual buffer size when Basic Encoding Rules (BER) multibyte length encoding is used. A remote attacker can send a crafted SNMP packet with a multibyte OID length that exceeds the available buffer, causing the parser to perform an out-of-bounds read into adjacent heap memory. These bytes are then decoded as OID component values and written into the agent's internal OID string buffer, leading to state corruption. On systems with memory protection, this can crash the SNMP agent thread and cause a denial of service, while on bare metal embedded systems without memory protection, the read may silently corrupt the internal state with heap data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** simple-git versions prior to 4.0.0 **Description** The default `blockUnsafeOperationsPlugin` compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced push arguments, such as abbreviated forms of `--receive-pack` or `--exec`, to bypass the `detectVulnerableFlags` function. Consequently, Git may invoke an attacker-selected command when these arguments are passed to a local or file remote, or an attacker-influenced receive-pack target. **Recommendations** Update to version 4.0.0.