Gandalf4A

The issue is related to a heap-buffer overflow in Vim when switching to other buffers using the :all command while visual mode is still active. This occurs because Vim does not properly end visual mode, potentially allowing access beyond the end of a line in a buffer. The impact is considered medium, as the user must have switched on visual mode when executing the :all ex command.

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.0764 Description: The issue is related to a use-after-free problem in the BufWinLeave function of the Vim text editor. This occurs when a buffer is closed and the BufWinLeave auto command is triggered, potentially causing the same buffer to be reopened in a new split window. The impact is considered low, as it requires a specific setup and intentional actions by the user. However, it may lead to a crash. There are no known instances of this issue being exploited in real-world attacks. Recommendations: For versions prior to 9.1.0764, upgrade to version 9.1.0764 or later to resolve the issue. As a temporary workaround, consider disabling the `BufWinLeave` auto command until a patch is available. Avoid using the `BufWinLeave` auto command in scenarios where it may cause a buffer to be reopened in a new split window.

The issue is related to an integer overflow that has been addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination.

The issue is related to a SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in the `ecma get object type` function.

The issue is an out-of-bounds read in the `r bin object set items` function located in `libr/bin/bobj.c`, which causes a crash in the `r read le32` function in `libr/include/r endian.h`.

The issue is related to a heap-use-after-free vulnerability. When executing a `:s` command for the first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later be accessed by the initial `:s` command. The user must intentionally execute the payload, and the process is tricky to do since it seems to work only reliably for the very first `:s` command. It may also cause a crash of Vim.

The issue is related to the `gf filterpacket del()` function in the `/gpac/src/filter core/filter.c` file of the GPAC multimedia platform. It involves incorrect use of dynamic memory, which can be exploited to impact the confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely, potentially leading to a denial of service.

The issue is related to a heap-use-after-free via the `flush ref samples` function at `/gpac/src/isomedia/movie fragments.c`. This is associated with incorrect dynamic memory usage during program execution. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. It can also lead to a denial of service when exploited remotely.

The issue is related to a stack overflow in the `hevc parse vps extension` function, located in the `media tools/av parsers.c` file. This is caused by incorrect use of dynamic memory during program execution. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. It can also be exploited remotely to cause a denial of service.

An out-of-bounds read exists in the `print insn32 fpu` function of `libr/arch/p/nds32/nds32-dis.h`. This issue affects versions of radare2 prior to version 5.8.9.

An out-of-bounds read exists in the `print insn32` function of `libr/arch/p/nds32/nds32-dis.h`. This issue affects radare2 versions prior to 5.8.9.