Junius-Sec

A NULL pointer dereference in the SQLite Session Extension allows an attacker to cause a denial of service by supplying a malformed changeset blob. This occurs when the `sqlite3changeset apply v3()` function applies a corrupt changeset and calls `sqlite3 value type()` using a NULL `sqlite3 value` pointer.

An out-of-bounds read occurs in the `TT Get Var Design()` implementation, which is utilized by `FT Get Var Design Coordinates()`. This issue is located within the `src/truetype/ttgxvar.c` file. An out-of-bounds read is a condition where a program reads data past the end of the intended buffer, potentially leading to information disclosure or system crashes.

A NULL pointer dereference occurs in the `smooth parse stream index()` function within the `src/media tools/mpd.c` file. This issue allows attackers to trigger a denial of service. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is NULL, typically resulting in a crash.

A buffer overflow allows an attacker to cause a denial of service. This issue occurs within the `src/scenegraph/svg attributes.c` file, specifically involving the `svg parse strings()` and `gf svg parse attribute()` functions.