Fernando Muñoz

A stack-based buffer overflow issue has been identified.

The issue allows local users to bypass the restricted shell and cause a use-after-free via a crafted address, potentially related to the `popd` command in bash. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

A use-after-free issue exists in libcurl, allowing attackers to potentially control which connection is used or have other unspecified impacts. This issue arises when an application uses libcurl's multi interface and an easy handle is added to a multi handle. If `curl multi cleanup()` is called with an easy handle still added to it, a pointer to a freed connection struct can be left dangling in the easy handle. If the easy handle is then used again with `curl easy perform()`, it can blindly use the connection struct pointer now pointing to freed memory, potentially leading to unintended actions. This flaw can be exploited by an application allocating its own fake version of the connection struct and filling in data, causing `curl easy perform()` to perform unintended actions.

The issue concerns the autoupdate implementation, which uses unsigned installer files retrieved without SSL. This makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.

The issue is related to a heap-based buffer overflow in the `ParseValue` function in `lexer.c`. This allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an `href`.

The issue allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation. This occurs due to a problem in the `ParseValue` function in `lexer.c`.

The issue is related to a use-after-free vulnerability that can be triggered by remote attackers using a crafted WMF file. This can cause a denial of service, leading to a crash, specifically when the file is processed by the wmf2gd or wmf2eps command.

A heap-based buffer overflow issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP image.

The issue is related to a heap-based buffer overflow in the DecodeImage function, which can be triggered by a crafted "run-length count" in an image in a WMF file. This can cause a denial of service (crash) or possibly allow remote attackers to execute arbitrary code.

The issue allows remote attackers to cause a denial of service, specifically an out-of-bounds read, by using a crafted WMF file.

A heap-based buffer overflow issue exists due to an error when processing a JPEG stream within a PDF file. This can be exploited to execute arbitrary code via a crafted Define Huffman Table header in a JPEG image file stream. Successful exploitation requires tricking a user into opening a malicious PDF document.