Haind

SDL mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2 schunk get slice buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2 schunk open() or blosc2 schunk from buffer() and read as a slice, raising SIGFPE and terminating the process.

SDL mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

sngrep through 1.9.0 contains an infinite loop vulnerability in capture packet reasm ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.

libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu parse stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip check packet and sip validate packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in zbar sq decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

An out-of-bounds read occurs in the `m se decode()` function within `src/decode.c`. This issue allows attackers to bypass a signed bounds check by using an overlong fundamental sequence. By providing a specially crafted CCSDS 121.0/SZIP stream containing 2^31 or more zero bits, an attacker can cause the decoder to crash or leak adjacent memory into decoded samples.

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs decompress lzvn attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom read hdlr() and isom read dref entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine:: add annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

Kvazaar through 2.3.2 contains an infinite loop vulnerability in read header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs load extended attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

A one-byte stack buffer under-read exists in the `ini parse stream()` function within the `ini.c` file. This occurs when an attacker provides an INI file or string containing a line of at least `INI MAX LINE-1` bytes followed by an embedded NUL byte, allowing the reading of `abyss[-1]` and resulting in undefined behavior.

The MS-ZIP decompressor contains an uninitialized memory disclosure issue. An attacker can use a specially crafted MS-ZIP CAB file where the first block starts with a back-reference, leading the `cabd->extract()` function to write up to 32 KiB of stale heap memory into the extracted output. This allows for the leakage of heap data due to unchecked back-reference distances.

An out-of-bounds read occurs when the software processes packets with forged IP payload lengths. Unauthenticated attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files, leading to the leakage of adjacent process memory into reconstructed flow files or causing the application to crash.

A heap out-of-bounds write occurs in the `af get page()` function. This happens when crafted AFF images are provided with mismatched page and sector sizes, specifically when the page size is larger than and not a multiple of the sector size. This discrepancy causes the sector zero-fill loop to write beyond the allocated buffer, leading to heap memory corruption and the crashing of forensic tools.

A stack out-of-bounds read exists in the `IMG LoadLBM IO()` function within `src/IMG lbm.c`. The issue occurs when HAM mode is enabled, as the software fails to validate the bitplane count. An attacker can provide a specially crafted ILBM file containing more than 8 HAM bitplanes to read beyond the colormap stack array, which may lead to application crashes or the disclosure of stack memory.