Feng Xue

An out-of-bounds write issue exists due to insufficient bounds checking. An attacker who controls a network file server can exploit this to cause unexpected system termination.

On ARM64 and RISC-V platforms, the SM2 curve utilizes a scalar multiplication implementation that is not constant-time. Because conditional branches and table lookups are determined by the bits of the secret scalar, the execution time and cache-access patterns depend on the long-term private key during decryption or the per-signature nonce during signature generation. This creates a timing and cache side-channel that allows an attacker to learn information about the secret scalar.

A double free issue exists in the QUIC server when processing an INITIAL packet. The default packet handler `port default packet handler()` creates a QRX (QUIC record layer RX) object for packet validation. If the subsequent channel creation via `port bind channel()` fails, the QRX object is freed. However, `port default packet handler()` also attempts to free the same QRX object upon detecting the failure, leading to heap corruption and a Denial of Service (DoS) through process termination. This condition can be triggered by sending a malformed INITIAL packet where the `DCID` (destination connection ID) is shorter than 8 bytes, causing `port bind channel()` to fail after `ossl quic lcidm enrol odcid()` detects the invalid length.

A crash in the CSN.1 protocol dissector can lead to a denial of service.

A heap-based buffer overflow in the Bluetooth AVRCP Profile protocol dissector can lead to a crash, resulting in a denial of service.

A crash in the SPDY protocol dissector can lead to a denial of service. A dissector is a software component that breaks down network traffic into a human-readable format.

A crash in the SCTP protocol dissector allows a denial of service. A dissector is a software component that breaks down network traffic into a human-readable format.

A kernel vulnerability exists where an application may be able to leak sensitive kernel state. This issue is caused by insufficient input sanitization.