Haruto Kimura

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 152 Thunderbird versions prior to 152 **Description** Incorrect boundary conditions exist within the Libraries component of the Network Security Services (NSS), which is a set of libraries providing support for security standards. **Recommendations** Update Firefox to version 152. Update Thunderbird to version 152.

**Name of the Vulnerable Software and Affected Versions** OP-TEE versions 4.3.0 through 4.10.x **Description** A type confusion occurs in OP-TEE OS when processing an 'FFA MEM SHARE' request from the normal world. This issue specifically affects configurations where OP-TEE is set as a Secure Partition Manager Core (SPMC) for S-EL0 Secure Partitions, specifically when `CFG CORE SEL1 SPMC=y` and `CFG SECURE PARTITION=y` are enabled. **Recommendations** Update to version 4.11.0.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An attacker can cause the allocation of large entries in the negative and aggressive NSEC(3) caches by publishing and querying a crafted zone. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerDNS dnsdist versions 1.9.0 through 1.9.12 PowerDNS dnsdist versions 2.0.0 through 2.0.3 **Description** An unauthenticated remote attacker can cause a denial-of-service by sending a crafted DNSCrypt query. This action triggers a divide-by-zero error, which leads to a crash of internet-facing instances with DNSCrypt enabled. **Recommendations** Update PowerDNS dnsdist versions 1.9.0 through 1.9.12 to version 1.9.13. Update PowerDNS dnsdist versions 2.0.0 through 2.0.3 to version 2.0.4.

**Name of the Vulnerable Software and Affected Versions** Unbound (affected versions not specified) **Description** Concurrent transfers of the same Response Policy Zone (RPZ) can result in inconsistent RPZ data, use after free (a memory corruption issue where a program continues to use a pointer after it has been freed), and/or a crash of the recursor. This scenario typically occurs when an RPZ provider is malfunctioning. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 150 Firefox ESR versions prior to 140.10 Thunderbird versions prior to 150 Thunderbird versions prior to 140.10 **Description** Incorrect boundary conditions exist in the Libraries component in NSS. **Recommendations** Update Firefox to version 150. Update Firefox ESR to version 140.10. Update Thunderbird to version 150. Update Thunderbird to version 140.10.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 150 Firefox ESR versions prior to 115.35 Firefox ESR versions prior to 140.10 Thunderbird versions prior to 150 Thunderbird versions prior to 140.10 **Description** An issue exists in the Libraries component of NSS (Network Security Services). **Recommendations** Update to version 150 Update to version 115.35 Update to version 140.10 Update to version 150 Update to version 140.10

**Name of the Vulnerable Software and Affected Versions** gnutls versions prior to 3.8.13-1.1 **Description** No detailed information was provided regarding the nature of the security issues fixed in this package. **Recommendations** Update to version 3.8.13-1.1.

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.19.0 through 3.6.5, Mbed TLS version 4.0.0 Description A flaw exists in Mbed TLS that, due to insufficient protection of serialized SSL context or session structures, could allow an attacker who can modify these structures to cause memory corruption, potentially leading to arbitrary code execution. This is a result of Incorrect Use of Privileged APIs. Recommendations Update to a version beyond 3.6.5. Update to a version beyond 4.0.0.

**Name of the Vulnerable Software and Affected Versions** Mbed TLS versions 3.5.0 through 3.6.5 **Description** A buffer overflow exists in the `x509 inet pton ipv6()` function. This issue was addressed in versions 3.6.6 and 4.1.0. **Recommendations** Update to version 3.6.6 or 4.1.0.

Name of the Vulnerable Software and Affected Versions Mbed TLS versions through 3.6.5 TF-PSA-Crypto version 1.0.0 Description A buffer overflow can occur during the public key export process for FFDH keys. Recommendations Update Mbed TLS to a version later than 3.6.5. Update TF-PSA-Crypto to a version later than 1.0.0.

Name of the Vulnerable Software and Affected Versions Mbed TLS versions through 3.6.5 and 4.0.0 Description A flaw exists in the distinguished name parsing functionality, leading to a NULL pointer dereference. This can allow an attacker to write to address 0. Recommendations Update to a version later than 3.6.5. Update to a version later than 4.0.0.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions 5.8.4 and earlier **Description** An out-of-bounds heap read issue exists in the `wc PKCS7 DecodeEnvelopedData` function when processing crafted CMS EnvelopedData messages containing zero-length encrypted content. This issue could lead to a 1-byte heap read outside of allocated memory boundaries. Note that PKCS7 support is disabled by default. **Recommendations** Update wolfSSL to a version later than 5.8.4.

**Name of the Vulnerable Software and Affected Versions** wolfSSL wolfcrypt (affected versions not specified) **Description** A heap-based buffer overflow exists in the KCAPI ECC code path within the `wc ecc import x963 ex()` function. This allows a remote attacker to write data beyond the allocated buffer of the `pubkey raw` variable via a crafted, oversized EC public key point. The issue occurs because the WOLFSSL KCAPI ECC code path uses `XMEMCPY` without validating the input length, unlike the ATECC code path. This can be triggered during TLS key exchange when a malicious peer sends a crafted ECPoint in ServerKeyExchange. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wolfSSL (affected versions not specified) **Description** A heap-buffer-overflow issue exists in the `wolfSSL d2i SSL SESSION()` function. When deserializing session data with SESSION CERTS enabled, the lengths of certificate and session ID are read from untrusted input without validation, potentially leading to a heap memory overflow. A crafted session loaded from an external source is required to trigger this issue. Internal sessions are not affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wolfSSL version 5.8.4 **Description** A flaw exists in wolfSSL 5.8.4’s Encrypted Client Hello (ECH) support. A specially crafted ECH configuration from a malicious TLS server can trigger a stack buffer overflow on the client side. This could potentially lead to remote code execution or a client program crash. ECH is disabled by default and requires explicit enabling. The vulnerable function is `wc HpkeLabeledExtract`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.