Himanshu Anand

An issue exists where resources are allocated without limits or throttling, which allows an unauthorized attacker to cause a denial of service over a network through resource exhaustion.

A heap-based buffer overflow exists in Microsoft Windows Media Foundation. This issue allows an unauthorized attacker to elevate privileges locally on the system. A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially leading to memory corruption.

An out of bounds read occurs during the import of PICT images, which can be embedded in documents. The issue arises when importing an image that utilizes a colour palette, as the palette index within the image data is used without being verified against the total number of palette entries. This allows an index exceeding the last entry to read memory outside the allocated palette.

Improper encoding of non-finite IEEE 754 floating-point values (NaN, Infinity, or -Infinity) during MapMessage JSON serialization produces output that is not valid JSON. This occurs when `MapMessage.asJson()` or `MapMessage.getFormattedMessage(new String[]{"JSON"})` is used, as they emit bare tokens not permitted by RFC 8259. The issue is reachable if an application uses the event template resolver of JsonTemplateLayout or any other layout relying on these methods and logs a `MapMessage` containing an attacker-controlled floating-point value. This can result in malformed JSON, potentially corrupting log records or disrupting downstream log ingestion and parsing.

An improper access check allows unauthorized users to access datasets within the `com privacy` webservice endpoints.

An issue exists in the `ipv6 get data primitive` function (libnetutil/netutil.cc) where the IPv6 extension-header walk is not kept within the captured packet. This causes the pointer to advance past the buffer, leading the remaining-length computation to underflow to a large value. A scanned target or an on-path attacker can trigger out-of-bounds reads and a crash during raw IPv6 scans by returning a crafted IPv6 response with a truncated extension header.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.