Elhanan Haenel

A heap-based buffer overflow occurs in the memcached client. A heap-based buffer overflow is a memory corruption issue that happens when an application writes more data to a heap-allocated buffer than it can hold.

A heap-based buffer overflow occurs in the redis client of the Apache Portable Runtime Utility. A heap-based buffer overflow is a memory corruption issue that happens when a program writes more data to a heap-allocated buffer than it can hold.

An SQL Injection issue exists in the `apr dbd oracle` provider. This occurs due to the improper neutralization of special elements used in an SQL command, which could allow an attacker to manipulate database queries.

A buffer overflow occurs in the `mod proxy html` module, which can be triggered by an untrusted backend.

A buffer over-read issue exists in the `mod proxy ajp` module, specifically within the `ajp parse data()` function. This flaw can lead to a heap over-read and memory disclosure, potentially exposing sensitive memory data. A buffer over-read occurs when a program reads more data from a buffer than it is intended to, which can lead to the leakage of adjacent memory contents.

A heap-based buffer overflow exists in the `mod proxy ajp` module. If `mod proxy ajp` connects to a malicious AJP server, that server can send a crafted AJP message causing the system to write four attacker-controlled bytes beyond the end of a heap-based buffer, leading to memory corruption.

A flaw exists in the RAR5 archive decompression logic within the `archive read data()` processing path of the libarchive library. Processing a specially crafted RAR5 archive can cause the decompression routine to enter a state preventing progress, resulting in an infinite loop that continuously consumes CPU resources. The archive appears structurally valid and passes checksum validation, making detection difficult for affected applications before processing. This can lead to persistent denial-of-service conditions in services that automatically process archives.

An issue exists in libarchive’s zisofs decompression logic. Improper validation of the `pz log2 bs` field read from ISO9660 Rock Ridge extensions can lead to undefined behavior. An attacker can exploit this by providing a specially crafted ISO file. This can result in incorrect memory allocation and potential application crashes, leading to a denial-of-service (DoS) condition.

An out-of-bounds read issue exists in the `mod proxy ajp` module of Apache HTTP Server, specifically within AJP getter functions. This flaw allows a remote attacker to read memory outside the intended range, which could lead to the disclosure of sensitive information.