Duc Anh Nguyen

Processing a maliciously crafted Bluetooth packet may lead to an out-of-bounds read, which occurs when the system reads data outside the intended boundary of a buffer. This can result in the disclosure of process memory.

An improper access control flaw exists in UniFi OS Server. The issue occurs because nginx evaluates the raw request URI for authentication purposes but performs routing using the normalized URI. This discrepancy allows unauthenticated remote attackers to bypass security controls, access protected endpoints, and execute an exploit chain leading to full root remote code execution (RCE), which is the ability to execute arbitrary commands on the system. This could enable unauthorized reading, modification, or deletion of data and the ability to make unauthorized changes to the system.

An out-of-bounds write occurs when processing crafted OOXML documents that contain mismatched encryption salt parameters. An out-of-bounds write is a memory corruption issue where data is written outside the intended boundary of a buffer, potentially leading to crashes or arbitrary code execution.

A heap overflow exists in the TLS protocol dissector. A remote attacker can exploit this issue by sending malformed packets or malicious capture files, potentially leading to a denial of service or the execution of arbitrary code. In real-world scenarios, attackers may use this to achieve code execution and subsequently pivot laterally across network infrastructure.

A crash in the ZigBee protocol dissector allows for a denial of service.

A crash in the RDP protocol dissector allows for denial of service and possible code execution.

A crash in the SBC codec can lead to a denial of service and potentially allow for arbitrary code execution.