Deus Rex

Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus gss assist token get fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service.

xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory.

xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read xschem file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash.

Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN TLV Buffer To DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF SSD file read by libchipcard's ZKA driver, to crash the application.

apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.

Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN TLV Buffer To DB() in src/parser/tlv.c, which frees a nested record's GWEN DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.

EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check edf file() that allows attackers to overflow the 256-element annot ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 annotation signals to overwrite edfhdrblock members, including the signal parameter pointer, crashing the application when opened.

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn Endpoint::handle sender message() and handle type message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER DESCRIPTION or TYPE DESCRIPTION message with an out-of-range or negative index to crash the process.

NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG MAX SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

A heap-based buffer overflow exists in Lz4Decoder.cpp, allowing unauthenticated network peers to write past heap buffers. This occurs when an attacker specifies a small `ring buffer size` followed by a large `decompressed size`, enabling the writing of up to 65535 controlled bytes, which can lead to a collector crash.

An integer overflow exists in the Forwarder output plugin. Unauthenticated IPFIX exporters can trigger a heap buffer overflow by wrapping `uint16 t` message length counters. This occurs when attackers send large templates and data sets near 65,535 bytes to a collector forwarding over TCP, potentially leading to a system crash or allowing 2-byte writes to addresses influenced by the attacker.

An issue exists in the `Lz4Decoder::read start header()` function where unauthenticated attackers can cause memory exhaustion. By opening TCP connections and sending LZ4 start headers with unbounded ring buffer sizes, an attacker can force allocations of up to 4 GiB per connection, resulting in a denial of service for the collector.

An out-of-bounds read occurs in the `handleSMessage()` function within short.c. This issue allows a malicious server or an attacker intercepting the plaintext TCP connection to cause a client crash by sending SP S MESSAGE packets where the `m recpt` index is 36 or greater. This results in the system reading beyond the `players[]` and `shipnos` arrays, leading to a denial of service.

A heap buffer overflow exists in the synchronous TCP and TLS client within the `handleReadHeader()` function of `TurnTcpSocket` (also inherited by `TurnTlsSocket`). This occurs when a malicious TURN server or an on-path attacker sends STUN or ChannelData frames with oversized lengths up to 65535 bytes. This action allows the attacker to write approximately 57 KB beyond the fixed 8192-byte `mReadBuffer`, leading to memory overwrite and client crashes. A heap buffer overflow is a condition where a program writes more data to a heap-allocated memory block than it can hold.

A stack-based buffer overflow exists in the `handleSMessage()` function within short.c. This issue occurs when the client processes oversized SP S MESSAGE packets, allowing a malicious server or a man-in-the-middle attacker on a plaintext TCP connection to overflow a 100-byte stack buffer. By sending overlong or unterminated message bodies, an attacker can write controlled bytes onto the stack, leading to a client crash.

For updatable cursors, which are enabled by default, the driver adds hidden `ctid` and `oid` columns to the query. The driver copies each value into a 32-byte stack buffer using the length sent by the server without verifying it against the buffer size. A value of 32 bytes or more can cause a buffer overflow, writing past the buffer. This can be triggered by a server not trusted under current SSL settings or by a database user capable of creating a view with a column named `ctid` that the application reads using an updatable cursor. Depending on the build, this may result in an application abort or the overwriting of adjacent stack memory.