Daniel Birtwhistle

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** wicked versions prior to 0.6.81 **Description** An integer underflow exists in the DHCPv4 packet capture code of the `wickedd-dhcp4` client. The function `ni capture inspect udp header()` in `src/capture.c` fails to verify that the IP total length field `ip len` is at least as large as the IP header length `ihl` before performing subtraction. An unauthenticated attacker on the same network can exploit this to trigger an out-of-bounds read past the receive buffer, potentially causing the daemon to crash depending on the process memory layout. **Recommendations** Update wicked to a version later than 0.6.80.

**Name of the Vulnerable Software and Affected Versions** wicked versions prior to 0.6.81 **Description** An out-of-bounds read exists in the DHCPv4 packet capture code. The function `ni capture inspect udp header()` in `src/capture.c` incorrectly reports the IP total length as the payload length instead of the remaining UDP payload length. This causes the DHCP option walker in the DHCPv4 client (`wickedd-dhcp4`) to read up to 68 bytes beyond the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to force the client to parse adjacent heap memory as DHCP options, potentially allowing heap contents like allocator metadata or pointer values to be interpreted as lease fields. **Recommendations** Update wicked to a version later than 0.6.80.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 **Description** A heap-based buffer overflow in the dissection engine can lead to a crash, resulting in a denial of service. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially corrupting memory. **Recommendations** Update Wireshark versions 4.6.0 through 4.6.7 to a version newer than 4.6.7. Update Wireshark versions 4.4.0 through 4.4.18 to a version newer than 4.4.18.