Ezinne Kalu

Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses the bounds check. This issue affects Walrus: ff3bf5ff5c4878f8e5572c9593d303f6bc997443.

**Name of the Vulnerable Software and Affected Versions** Samsung Open Source TizenFX (affected versions not specified) **Description** An out-of-bounds write and improper validation of array index in Samsung Open Source TizenFX allows for buffer overflows. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is designed to hold, potentially overwriting adjacent memory locations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse SW360 versions 19.0.0 through 20.1.0 **Description** When the system is configured to use file system storage via the `enable.attachment.store.to.file.system` config key, an attacker can manipulate the filename during upload. This allows for arbitrary file path traversal, a technique used to access files and directories that are stored outside the intended folder. **Recommendations** Update to a fixed version. Disable the `enable.attachment.store.to.file.system` configuration key as a temporary workaround.