Ilja Van Sprundel

The `Stream EnsureCapacity` function in FreeRDP versions prior to 3.23.0 can create an endless blocking loop. This issue may affect all client and server implementations using FreeRDP. Exploitation is practical on 32bit systems with physical memory greater than or equal to `SIZE MAX`.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is caused by a buffer overflow in the struct qib user sdma pkt fields. Overflowing either `addrlimit` or `bytes togo` can allow userspace to trigger a buffer overflow of kernel memory. The vulnerability can be exploited to gain access to confidential information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient input validation when handling SCTP packets, which may allow a remote attacker to gain unauthorized access to protected information. This could lead to remote information disclosure to an on-path attacker with no additional execution privileges needed. The vulnerability is due to a missing bounds check in functions such as `sctp v6 to sk daddr` and `sctp v4 from addr param`, potentially causing an out of bounds read. User interaction is not required for exploitation.

The issue is related to memory corruption in certain functions, including IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry, and IntLixFileGetPath, due to insufficient validation of guest-data input. This may lead to denial of service conditions.

The issue is related to a lack of validation on data read from guest memory in several functions, including IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol, and IntLixTaskDumpTree. This lack of validation may lead to out-of-bounds read or cause a Denial of Service (DoS) due to integer overflow in IntPeGetDirectory, Time-of-Check-to-Time-of-Use (TOCTOU) in IntPeParseUnwindData, or insufficient validations.

An issue in xenoprof allows guest OS users without active profiling to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed.

An issue in xenoprof allows guest OS users with active profiling to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. The xenoprof code uses the standard Xen shared ring structure for guests with active profiling enabled by the administrator. However, it trusts the guest not to modify buffer size information or head/tail pointers in unexpected ways, which can lead to a host crash (DoS). Privilege escalation cannot be ruled out.

The issue is related to the incorrect use of a user-controlled pointer in the epair virtual network module. This allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel.

The issue is related to buffer overflow errors in the eap request and eap response functions of the pppd daemon in the Point-to-Point Protocol (PPP). Exploitation of this issue may allow a remote attacker to cause a denial of service or execute arbitrary code using a specially crafted EAP packet. The vulnerability can be exploited by sending specially formatted authentication requests to systems using the PPP or PPPoE protocols, which are commonly used by providers for Ethernet or DSL connections and in some VPNs.

The issue is due to insufficient initialization of memory copied to userland, which may disclose small amounts of kernel memory to userland processes. Unprivileged users may be able to access small amounts of privileged kernel data.

The issue is related to insufficient error handling in the dmcrypt-get-device utility, which is part of the eject package in Debian and Ubuntu. This utility does not check the return value of the `setuid` or `setgid` function, potentially allowing an attacker to execute code with root privileges that was intended for an unprivileged user.

The issue is related to the SMBClient component in Apple OS X, which lacks protection of service data. This allows a local attacker to potentially obtain sensitive kernel memory-layout information. The vulnerability can be exploited by a local user to access protected information in the kernel memory.

The issue is caused by a buffer overflow in the IOGraphics component of the Mac OS X operating system. Exploitation of this issue may allow a local attacker to elevate privileges or cause a denial of service.

The issue is related to a buffer overflow in the SMB implementation of the Mac OS X kernel. This can be exploited by a local attacker to gain elevated privileges or cause a denial of service, resulting in memory corruption.

The issue is caused by a buffer overflow in the IOGraphics component of the Mac OS X operating system. Exploitation of this issue may allow a local attacker to elevate privileges or cause a denial of service.

The issue is caused by a buffer overflow in the IOGraphics component of the Mac OS X operating system. Exploitation of this issue may allow a local attacker to elevate privileges or cause a denial of service.

The issue is caused by a buffer overflow in the IOGraphics component of the Mac OS X operating system. Exploitation of this issue may allow a local attacker to elevate privileges or cause a denial of service.

The issue is related to the IOStorageFamily component in the iOS operating system, which lacks protection for certain internal data. This can be exploited by a local attacker to gain access to sensitive information by manipulating the system's kernel memory. The vulnerability allows local users to obtain sensitive information from kernel memory, although the exact vectors used for this are not specified.

The issue is caused by a buffer overflow in the IOGraphics component, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted app, resulting in memory corruption.

The issue is caused by a buffer overflow in the IOFireWireFamily component of the Mac OS X operating system. Exploitation of this issue may allow a local attacker to elevate their privileges or cause a denial of service.