Gutiniaoo

**Name of the Vulnerable Software and Affected Versions** gpac version 0.8.0 **Description** An issue exists in the function `FixTrackID` located in `isom intern.c`, which allows attackers to cause a denial of service (DoS) via a crafted input. This is due to an invalid memory dereference. **Recommendations** For gpac version 0.8.0, consider disabling the `FixTrackID` function as a temporary workaround until a patch is available. Restrict access to the `isom intern.c` file to minimize the risk of exploitation. Avoid using crafted inputs that may trigger the denial of service.

**Name of the Vulnerable Software and Affected Versions** gpac version 0.8.0 **Description** An issue was discovered in the gf media nalu remove emulation bytes function in av parsers.c, which has a heap-based buffer overflow. This can lead to a denial of service (DOS) via a crafted input. **Recommendations** For gpac version 0.8.0, consider disabling the `gf media nalu remove emulation bytes` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gpac version 0.8.0 **Description** A memory leak in the `senc Parse` function in MP4Box allows attackers to cause a denial of service (DoS) via a crafted input. **Recommendations** For gpac version 0.8.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** gpac version 0.8.0 **Description** The issue is related to a memory leak in the `sgpd parse entry` function in MP4Box, which allows attackers to cause a denial of service (DoS) via a crafted input. **Recommendations** For gpac version 0.8.0, consider updating to a newer version that contains a fix for this issue, as the current version is affected by a memory leak in the `sgpd parse entry` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gpac version 0.8.0 **Description** An issue was discovered in the GetGhostNum function in stbl read.c, which has a heap-based buffer overflow. This can lead to a denial of service (DOS) via a crafted input. **Recommendations** For gpac version 0.8.0, as a temporary workaround, consider disabling the GetGhostNum function in stbl read.c until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gpac version 0.8.0 **Description** An issue was discovered in the dump data hex function in box dump.c, which has a heap-based buffer overflow. This can lead to a denial of service (DOS) via a crafted input. **Recommendations** For gpac version 0.8.0, consider restricting the use of the dump data hex function in box dump.c until a patch is available. As a temporary workaround, avoid using crafted inputs that may trigger the heap-based buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 0.8.0 **Description** The issue is related to a stack-based buffer overflow in the `dimC Read` function, located in the `isomedia/box code 3gpp.c` file of GPAC. **Recommendations** For GPAC version 0.8.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** libsixel version 1.8.4 **Description** A memory leak was discovered in the `image buffer resize` function in `fromsixel.c` in libsixel. **Recommendations** For libsixel version 1.8.4, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** libsixel versions prior to 1.8.4 **Description** A heap-based buffer overflow was discovered in the image buffer resize function in fromsixel.c. **Recommendations** For versions prior to 1.8.4, update to version 1.8.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** matio version 1.5.17 **Description** A memory leak was discovered in the `Mat VarCalloc` function in `mat.c` due to the `SafeMulDims` function not considering the case where `rank` equals 0. **Recommendations** For matio version 1.5.17, consider applying a patch or fix that addresses the issue in the `SafeMulDims` function to prevent memory leaks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UPX version 3.95 ALT Linux (affected versions not specified) **Description** An issue was found in the canUnpack function in p mach.cpp, which can be triggered by a crafted Mach-O file, leading to an invalid memory address dereference. **Recommendations** For UPX version 3.95, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ALT Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UPX version 3.95 **Description** A floating-point exception was discovered in PackLinuxElf::elf hash in p lx elf.cpp, causing an application crash that leads to denial of service. **Recommendations** For UPX version 3.95, consider updating to a newer version to mitigate the risk, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `PackLinuxElf::elf hash` function in `p lx elf.cpp` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** matio version 1.5.17 **Description** A stack-based buffer over-read issue was found in the Mat VarReadNextInfo5 function in mat5.c. **Recommendations** For matio version 1.5.17, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** matio version 1.5.17 **Description** A stack-based buffer over-read issue was found in the ReadNextCell function in mat5.c. **Recommendations** For matio version 1.5.17, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** matio version 1.5.17 **Description** An issue was found in the matio library where an attempted excessive memory allocation occurred in the Mat VarRead5 function in mat5.c. **Recommendations** For matio version 1.5.17, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** matio version 1.5.17 **Description** A stack-based buffer over-read was discovered in the ReadNextStructField function in mat5.c. **Recommendations** For matio version 1.5.17, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** UPX version 3.95 **Description** A heap-based buffer over-read issue was found in the canUnpack function in p mach.cpp via a crafted Mach-O file. **Recommendations** For UPX version 3.95, consider updating to a newer version that contains a fix for this issue, as using a crafted Mach-O file could trigger the heap-based buffer over-read in the canUnpack function in p mach.cpp. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libsixel versions prior to 1.8.3 **Description** An invalid memory address dereference was found in the load pnm function in frompnm.c. **Recommendations** For versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libmysofa before 2019-11-24 **Description** The issue is related to the improper restriction of recursive function calls, which can lead to stack consumption. This has been demonstrated in functions such as `readOHDRHeaderMessageDatatype` in `dataobject.c` and `directblockRead` in `fractalhead.c`. **Recommendations** For libmysofa versions before 2019-11-24, download and update to version 0.9 or later, which should fully remediate this issue, as long as the download is made after 2019-12-06.