Fuzzinglabs

**Name of the Vulnerable Software and Affected Versions** RTKLIB versions prior to 2.4.3 **Description** An off-by-one out-of-bounds read exists in the `decode ssr3()` function within the `src/rtcm3.c` file. This issue occurs when processing crafted RTCM3 SSR messages containing attacker-controlled signal mode fields, which can trigger a global buffer overflow. Remote attackers can exploit this by sending malicious SSR correction streams via NTRIP or serial connections, potentially leading to a denial of service or causing RTKLIB rovers and CORS servers to crash. **Recommendations** Update RTKLIB to a version newer than 2.4.3. As a temporary mitigation, restrict the processing of SSR correction streams from untrusted sources.

**Name of the Vulnerable Software and Affected Versions** libais versions prior to 0.16 **Description** The `VdmStream::AddLine()` function uses an unchecked sentinel value as a vector index when processing AIS sentences that contain empty or out-of-range sequential message IDs. This leads to out-of-bounds memory access and potential corruption, allowing remote attackers to crash services or vessel systems by sending crafted AIVDM sentences via VHF marine radio or IP feeds. **Recommendations** Update libais to version 0.16 or later.

**Name of the Vulnerable Software and Affected Versions** RTKLIB versions prior to 2.4.4 **Description** An out-of-bounds write occurs in the `decode type1033()` function because length counters are not clamped to the destination buffer size. This allows an overflow of up to 191 bytes into fixed 64-byte descriptor fields. An attacker who controls an NTRIP or serial RTCM3 correction stream can send a crafted type-1033 message with a valid CRC to corrupt adjacent `rtcm t` object members, which may lead to arbitrary code execution or denial of service. **Recommendations** Update to a version newer than 2.4.3.

**Name of the Vulnerable Software and Affected Versions** CANBoat versions prior to 6.23 **Description** An off-by-one global buffer overflow exists in the `searchForPgn()` function within the analyzer/pgn.c file. A remote attacker can trigger an out-of-bounds array access and cause a denial of service, resulting in an application crash, by sending a crafted NMEA-2000 message containing an out-of-range PGN value via the CAN bus or N2K-over-IP. **Recommendations** Update to the version containing commit a5a22b7.

**Name of the Vulnerable Software and Affected Versions** RTKLIB versions prior to 2.4.4 **Description** An out-of-bounds read occurs in the `getcodepri()` function when processing unrecognized RINEX observation codes. This happens when crafted RINEX files containing unknown observation types cause negative array indexing into the `codepris` table. This flaw can lead to a denial of service through reliable crashes or the potential memory disclosure of adjacent global data. **Recommendations** Update to a version newer than 2.4.3.

**Name of the Vulnerable Software and Affected Versions** RTKLIB versions prior to 2.4.4 **Description** A heap buffer overflow occurs in the `readrnxobsb()` function within `src/rinex.c` due to a failure to clamp satellite count values from RINEX epoch headers. An attacker can provide a malicious RINEX file specifying more than 64 satellites per epoch, leading to heap buffer overflow writes and out-of-bounds stack reads. This results in memory corruption and crashes in RTKLIB-based applications, such as `rnx2rtkp` and `RTKPOST`. **Recommendations** Update RTKLIB to version 2.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** QVR Pro versions prior to 2.7.4.14 **Description** QVR Pro is affected by a missing authentication check for critical functions, allowing remote attackers to gain access to the system. The issue allows attackers to bypass authentication and access QVR Pro surveillance systems. The vulnerability has a CVSS score of 9.3, indicating a critical severity. It is described as a 'network-accessible goldmine for instant system compromise'. No information is available regarding the number of potentially affected devices or real-world exploitation incidents. **Recommendations** Update QVR Pro to version 2.7.4.14 or later.