Hazley Samsudin

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A use-after-free issue exists in the implementation of an ioctl, which occurs when the system attempts to acquire locks on all channels in a sync group. If locking a channel blocks, the system releases the sync group list lock and sleeps; however, it fails to handle cases where the sync group structure is freed before the system reawakens. On systems with multiple audio devices, an unprivileged local user can exploit this to escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD version 15.0 **Description** A change in the kernel structure for user credentials caused the `group is primary()` function to be improperly updated. This function is utilized by `mac do` to determine the primary group ID of a credential after applying a transition rule when the target does not explicitly specify a group. Consequently, specific `mac do` rules can be abused to incorrectly set the primary group ID to the value stored in the first element of the original credential's supplementary group array. If the supplementary group list is empty, the primary group ID may be set to 0 (the wheel group), potentially allowing for privilege escalation to root depending on the system configuration. To trigger this, the rule must apply to the caller, and the process must typically remove all supplementary groups using the `setgroups(2)` system call. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A use-after-free issue exists in the kernel during the copying of knotes during a fork operation. A knote with a timer-based filter may fire and be enqueued on the kqueue active list before the copy process completes. Because the copy routine fails to account for this and does not hold appropriate locks while reading knote state, the new knote could be enqueued a second time, leading to active list corruption and race conditions. An unprivileged local user can exploit this to potentially achieve privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An unprivileged local user can obtain uninitialized kernel stack memory, potentially disclosing sensitive kernel data. This occurs when creating a POSIX timer with CLOCK TAI and calling the `timer settime(2)` function. The issue stems from the kernel calling `realtimer gettime()` to retrieve the previous timer value; if no TAI offset is configured, the function fails, but because the error return is not checked, the uninitialized output buffer is copied to userspace. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An integer overflow occurs in the `dsp mmap single()` function when validating requested mappings by summing a user-supplied offset and length against the buffer size. A large offset and length can wrap around, bypassing the check. Subsequently, the offset is narrowed from 64 to 32 bits during conversion to a buffer address, creating a mapping that extends beyond the audio buffer into unrelated kernel memory. Because `/dev/dsp` device nodes are world-accessible by default, an unprivileged local user can read and write kernel memory. This can lead to privilege escalation, full system control, or a Denial of Service (DoS) by crashing the kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Notepad++ version 8.9.3 **Description** A format string injection exists in the Find Results panel handler. This occurs when the application processes a maliciously crafted `nativeLang.xml` language pack file. An attacker can distribute a poisoned language pack through community channels; when a user performs search operations, the application triggers format string interpretation. This can lead to access violations, denial of service, and the potential leakage of stack or register contents (information disclosure). **Recommendations** As a temporary workaround, avoid installing or using untrusted `nativeLang.xml` language packs from community channels.

**Name of the Vulnerable Software and Affected Versions** Notepad++ versions prior to 8.9.4 **Description** A string injection issue exists in the FindInFiles search function due to flaws in the formatting string processing mechanism. Successful exploitation could allow an attacker to obtain sensitive memory address information or cause the application to crash (denial of service) by using a specially crafted file. This risk is particularly relevant for users utilizing custom `nativeLang.xml` localization files. **Recommendations** Update to version 8.9.4 or later. Avoid using untrusted configuration or localization files.