David Korczynski

FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc load cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc paint cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames.

An issue exists in the Client programs component of Oracle MySQL. This flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the system. A successful exploit can lead to a full takeover of the server or cluster.

An issue exists in the Group Replication Plugin of Oracle MySQL. An unauthenticated attacker with access to the physical communication segment attached to the hardware where the server executes can compromise the system. This may lead to a complete Denial of Service (DOS) by causing the server to hang or crash repeatedly, as well as unauthorized ability to update, insert, or delete accessible data.

An issue exists in the Pluggable Auth component of MySQL Server and MySQL Cluster. An unauthenticated attacker with network access via multiple protocols can compromise the system. Successful exploitation may lead to a complete Denial of Service (DOS) by causing the server to hang or crash repeatedly, as well as unauthorized ability to update, insert, or delete accessible data.

An issue exists in the Client programs component of Oracle MySQL. This flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the system. A successful exploit can lead to a full takeover of the server or cluster.

An issue exists in the Server: Replication component of Oracle MySQL. An unauthenticated attacker with network access via multiple protocols can compromise the system. Successful exploitation may lead to unauthorized creation, deletion, or modification of critical data and all accessible data. Additionally, it can result in a hang or frequently repeatable crash, leading to a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to its intended users.

An issue exists in the Client programs component of Oracle MySQL. This flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the system. A successful exploit can lead to a full takeover of the server or cluster.

A null pointer dereference exists in the PKCS#7 handling code used for IKE certificate authentication. The issue occurs when decoding an IKE CERT payload of type `CERT PKCS7 WRAPPED X509`. The software uses `SEC PKCS7ContainsCertsOrCrls()` to validate the PKCS#7 blob and subsequently uses `SEC PKCS7GetCertificateList()` to iterate the certificate list. A discrepancy between these two NSS APIs allows a SignedData object containing a CRL (Certificate Revocation List) but no certificates to pass the initial guard, while the subsequent list retrieval returns NULL. This leads to a null pointer dereference, causing the system to crash and restart. An unauthenticated peer can trigger this behavior by sending a malicious `IKE AUTH` packet, potentially resulting in a denial of service through repeated exploitation.

A null pointer dereference exists in the IKEv2 state machine within the EAP handling code for authentication. Due to an inconsistency in the state machine code, a fall-through occurs where the system incorrectly dereferences the `ike->sa.st eap` variable while it is NULL. This issue can be triggered by any IKEv2 connection via a malicious IKE AUTH packet, regardless of whether EAP is configured, and does not require the peer to be authenticated. Exploitation leads to a crash and subsequent restart of the pluto daemon, which can result in a denial of service. Remote code execution is not possible.

OpenSSL stream peer verification incorrectly handles certificate validation by falling back to the Common Name (CN) when no entries in the `subjectAltName` (SAN) match. According to RFC 6125, the CN should be ignored if the certificate contains any service identity. This behavior allows a certificate trusted for one name to be used to impersonate another if the CN matches the requested `peer name` despite a non-matching DNS SAN.

A client can send a WebSocket frame containing an unknown opcode and an excessively large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass standard maximum frame size checks, leading the system to attempt a large memory allocation before the opcode is validated. This process can exhaust the JVM heap, potentially causing a denial of service.

An attacker connecting to an open Erlang TCP port using the inet driver with `{packet,4}` mode can trigger a signed overflow due to an incorrect packet length calculation. This allows the receive buffer to overflow into the VM allocator area and beyond by up to 2 GB, which typically corrupts the allocator metadata footer and subsequent blocks, leading to a BEAM VM crash. Achieving Remote Code Execution through this method is considered extremely unfeasible.

An out-of-bounds read and write occurs in the `wrap lines measure()` function. This issue affects libass, a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format.

An out of bounds read in the GPU component allows a remote attacker to potentially exploit heap corruption through the use of a crafted HTML page. Heap corruption occurs when a program writes data outside the boundaries of the allocated memory on the heap, which can lead to crashes or arbitrary code execution.

An issue was discovered in Treasure Data Fluent Bit, where erroneous parsing in `flb pack msgpack to json format` leads to a type confusion bug. This bug interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. An attacker can craft a specially crafted file and trick the victim into opening it using the affected software, triggering use-after-free and executing arbitrary code on the target system.

The issue is related to the import of OCI images in containerd, where there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file could cause a denial of service.

The issue concerns a NULL Pointer Dereference in the `chartutil` package that can cause a segmentation violation. This package contains a parser that loads a JSON Schema validation file, which can be used by the Helm client to validate chart values. Certain schema files can cause array data structures to be created, leading to a memory violation. This can result in a Denial of Service when the input causes a panic that cannot be recovered from. The Helm client will panic with a schema file that causes a memory violation panic, but since Helm is not a long-running service, the panic will not affect future uses of the Helm client.

Helm is a tool for managing Charts, pre-configured Kubernetes resources. The issue results in Uncontrolled Resource Consumption, leading to Denial of Service. Input to functions in the ` strvals ` package can cause a stack overflow, which cannot be recovered from in Go. Applications using functions from the ` strvals ` package in the Helm SDK can suffer a Denial of Service attack when the package panics. The ` strvals ` package contains a parser that turns strings into Go structures, and some string inputs can cause array data structures to be created, leading to a stack overflow. The Helm Client will panic with input to flags like `--set`, `--set-string`, and other value setting flags that cause a stack overflow.

The issue is related to the strvals package in the Helm SDK, which contains a parser that turns strings into Go structures. Some string inputs can cause array data structures to be created, leading to an out of memory panic. Applications that use the strvals package to parse user-supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to an improper certificate validation bug in Argo CD, which could cause it to trust a malicious OpenID Connect (OIDC) provider. This bug affects connections to OIDC providers and can be exploited by an attacker to conduct spoofing attacks. The vulnerability is related to the skipping of certificate verification when communicating with the OIDC provider, which opens Argo CD to various risks, such as a machine-in-the-middle attack.