Fengyi Wang

Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/image/oci/oci load.c. This issue affects iSulad: through 2.1.6. When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.

A stack-based buffer overflow exists in the Zserv Handler component within the `rip zebra read ipv4()` function of the `/usr/sbin/ripd` file. This issue allows a remote attacker to execute a manipulation that could lead to a crash or arbitrary code execution. This software is no longer supported by its maintainer and has been superseded by FreshTomato.

A flaw in the SUBSCRIBE Call Handler component allows for server-side request forgery, a condition where an attacker can induce the server to make requests to an unintended location. The issue is located in the `send()` function within the `usr/sbin/miniupnpd` file and can be triggered remotely.

A remote attack can be launched against an unknown function within the `usr/sbin/miniupnpd` file, leading to resource consumption. This issue affects products that are no longer supported by the maintainer, as the project has been superseded by FreshTomato.