Jarlob

An uncontrolled recursion issue exists in the UFS/UFS2 filesystem image parser. The `GetAllPaths()` function recurses into subdirectories without depth limits or visited-inode tracking. A specially crafted UFS image containing an inode cycle or a deep directory tree can lead to stack exhaustion, resulting in a process crash.

A stack-based out-of-bounds read exists in the ZealFS filesystem image parser. This occurs when opening a specially crafted ZealFS v1 filesystem image, where an attacker-controlled `BitmapSize` field in the file header triggers an unbounded loop that reads past the end of a stack-allocated `ZEALFS V1 HEADER` structure.

A one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser. This occurs when opening a specially crafted UFS filesystem image, allowing an attacker to control the byte offset of the write within a approximately 254-byte window beyond the heap allocation boundary.

OpenCV, an Open Source Computer Vision Library, contains an issue where an uninitialized pointer variable on the stack can lead to an arbitrary heap buffer write when processing crafted JPEG images.

7-Zip is a file archiver with a high compression ratio. A flaw exists in the RAR5 handler where writing zeroes outside of the heap buffer can cause memory corruption and denial of service.

7-Zip is a file archiver that supports extracting from Compound Documents. A null pointer dereference in the Compound handler may lead to denial of service.

The issue concerns command-line audio/video downloaders `yt-dlp` and `youtube-dl`. Prior to the fixed versions, these tools do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since `yt-dlp` and `youtube-dl` also read config from the working directory, this could lead to arbitrary code being executed. To mitigate this, users should have `.%(ext)s` at the end of the output template, trust the websites they download from, and avoid downloading to sensitive locations.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in `f->vendor[i] = get8 packet(f);`. This is caused by an integer overflow in `setup malloc`, where a sufficiently large value in the variable `sz` overflows when added to 7, resulting in a negative value that passes the maximum available memory buffer check. This may lead to code execution.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of buffer write in the `start decoder` function. This occurs because the maximum value of `m->submaps` is 16, but the arrays `submap floor` and `submap residue` are declared with 15 elements. This can potentially lead to code execution.

The issue is related to the processing of ogg vorbis files. A crafted file can cause a memory allocation failure in the `start decoder` function, leading to some pointers in `f->comment list` being left initialized. Later, `setup free` is called on these pointers in `vorbis deinit`, which may result in code execution.

The issue concerns a crafted file that may trigger an out of bounds read in the `DECODE` macro when the `var` is negative. According to the definition of `DECODE RAW`, a negative `var` is a valid value. This can potentially be used to leak internal memory allocation information.

The issue is related to a memory allocation failure in the `start decoder` function when processing a crafted ogg vorbis file. This failure causes the function to return early, setting `f->comment list` to `NULL` but not resetting `f->comment list length`. Later, in the `vorbis deinit` function, it attempts to dereference the `NULL` pointer, potentially leading to a denial of service.

The issue is related to the stbi getn function in the stb image library, which reads a specified number of bytes from a context into a buffer. If the file stream points to the end, it returns zero. However, there are two places where its return value is not checked: in the `stbi hdr load` function and in the `stbi tga load` function. The latter is likely more exploitable as an attacker may also control the size of an uninitialized buffer.

The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in `f->vendor[len] = (char)'0';`. This occurs when `len` read in `start decoder` is a negative number and memory allocation is successful, but the memory write is done with a negative index `len`. Additionally, if `len` is INT MAX, an integer overflow happens in `f->vendor = (char*)setup malloc(f, sizeof(char) * (len+1));` and `f->comment list[i] = (char*)setup malloc(f, sizeof(char) * (len+1));`. This may lead to code execution.

The issue is related to a crafted image file that may trigger an out of bounds memcpy read in the `stbi gif load next` function. This occurs because `two back` points to a memory address lower than the start of the buffer, potentially leading to the leak of internal memory allocation information.

The issue is related to a global buffer read overflow in the `nsCodingStateMachine::NextStater` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a heap buffer read overflow in the `FileManager::detectLanguageFromTextBegining()` function. This may potentially be used to leak internal memory allocation information. The exploitability of this issue is not clear.

The issue is related to a crafted file that may trigger an out of bounds write in `f->vendor[len] = (char)'0';`. This occurs when the length read in `start decoder` is `-1` and `len + 1` becomes 0 when passed to `setup malloc`. The `setup malloc` function behaves differently when `f->alloc.alloc buffer` is pre-allocated, shifting the pre-allocated buffer by zero and returning the currently available memory block instead of returning `NULL` as in the `malloc` case. This may lead to code execution. The vulnerability may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted file.

The issue is related to the stbi load gif from memory component of the stb image library, which is a single file MIT licensed library for processing images. If `stbi load gif main` fails, it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi vertical flip slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to a potential integer overflow in `sizeof(char*) * (f->comment list length)` which may cause `setup malloc` to allocate less memory than required. This can lead to a memory write past an allocated heap buffer in `start decoder` when a crafted file is processed. An attacker may exploit this issue to gain access to confidential data, disrupt data integrity, and cause a denial of service. The issue may also lead to code execution.