Jeremy Brown

An out-of-bounds memory read and write issue exists in the GGUF (GPT-Generated Unified Format) quantization engine. This occurs because the engine lacks proper bounds checking and trusts tensor metadata, allowing reads beyond intended memory boundaries. An unauthenticated attacker can exploit this by uploading a specially crafted GGUF file, triggering the vulnerability during the quantization process to read and exfiltrate sensitive heap memory from the server. This may lead to unauthorized data access, system compromise, and stealthy persistence. Approximately 300,000 deployments are potentially affected.

A flaw exists in the GSSAPI patch included in various Linux distributions of OpenSSH, but does not affect the upstream OpenSSH project itself. The issue stems from the use of `sshpkt disconnect()` instead of `ssh packet disconnect()` when an error occurs during the GSSAPI key exchange process. This allows an attacker to send a crafted GSSAPI message type to the server, leading to the execution of code that accesses uninitialized variables and potentially causes random memory access, resulting in undefined behavior. The vulnerability can be exploited remotely before authentication, potentially leading to denial of service or other impacts. The severity of the impact depends on the compiler flag hardening configuration. A single, crafted SSH packet can trigger the issue.

A critical issue has been found in the API component, leading to privilege escalation through remote attack. The exploit has been disclosed publicly.

The issue allows a network user to cause detection of error conditions without action, potentially leading to limited code execution, denial of service, escalation of privileges, and impacts to data confidentiality and integrity.

The issue is related to insufficient input validation and a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service. A use after free issue was addressed with improved memory management, allowing a remote user to cause an unexpected app termination or arbitrary code execution.

The login routine of the web console fails to validate that a NULL byte was sent while authenticating, which could lead to a crash of the login service. This issue is related to a null pointer dereference, and its exploitation may allow an attacker to cause a denial of service.

The issue arises from the `ulfius uri logger` in the Ulfius HTTP Framework, which fails to initialize `con info` and perform a `con info->request` NULL check for certain malformed HTTP requests. This can lead to remote memory corruption.

An out-of-bounds read issue was addressed with improved bounds checking. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.

An out-of-bounds read issue was addressed with improved bounds checking. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.

A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. Processing a maliciously crafted image may lead to arbitrary code execution.

An out-of-bounds read issue was addressed with improved bounds checking. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.

An out-of-bounds read issue was addressed with improved bounds checking. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.

The issue is related to insufficient input validation, which could allow a remote attacker to execute arbitrary code. Specifically, the network proxy page on the web portal for certain Zoom products fails to validate input sent in requests to set the network proxy password, potentially leading to remote command injection by a web portal administrator.

A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web application on the underlying operating system of an affected Cisco Modeling Labs server. This vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected server. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web application, `virl2`, on the underlying operating system of the affected server. To exploit this vulnerability, the attacker must have valid user credentials on the web UI.

The software contains a directory traversal issue that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files, such as `/etc/passwd`, and retrieve Apache Cassandra database credentials.

The issue concerns hard-coded credentials, such as a password or cryptographic key, used by IBM Spectrum Protect Plus for inbound authentication, outbound communication to external components, or encryption of internal data.

The issue allows a remote attacker to execute arbitrary code on the system by using a specially crafted HTTP command. This can lead to the execution of arbitrary commands on the system.

The issue is related to the failure to neutralize special elements in user-input strings during password parameter syntax analysis in the Administrative Console Framework service of IBM Spectrum Protect Plus. This can be exploited by a remote attacker using a specially crafted HTTP command to execute arbitrary code on the system.

A critical issue was found, affecting an unknown part of the component API. This leads to Remote Privilege Escalation and can be initiated remotely. The exploit has been disclosed publicly.

The issue allows remote attackers to execute arbitrary code via a crafted PDF file.