Junius-Sec

**Name of the Vulnerable Software and Affected Versions** SQLite version 3.53.1 SQLite trunk builds prior to check-in e807d4e3798efd53 **Description** A NULL pointer dereference in the SQLite Session Extension allows an attacker to cause a denial of service by supplying a malformed changeset blob. This occurs when the `sqlite3changeset apply v3()` function applies a corrupt changeset and calls `sqlite3 value type()` using a NULL `sqlite3 value` pointer. **Recommendations** Update SQLite version 3.53.1 to a version containing the fix. Update SQLite trunk builds to check-in e807d4e3798efd53 or later.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to commit 5a280ecde6f324de0d226261036e736e0cb49a71 **Description** An out-of-bounds read occurs in the `TT Get Var Design()` implementation, which is utilized by `FT Get Var Design Coordinates()`. This issue is located within the `src/truetype/ttgxvar.c` file. An out-of-bounds read is a condition where a program reads data past the end of the intended buffer, potentially leading to information disclosure or system crashes. **Recommendations** Update FreeType to the version containing commit 5a280ecde6f324de0d226261036e736e0cb49a71.

**Name of the Vulnerable Software and Affected Versions** GPAC versions prior to commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 **Description** A NULL pointer dereference occurs in the `smooth parse stream index()` function within the `src/media tools/mpd.c` file. This issue allows attackers to trigger a denial of service. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is NULL, typically resulting in a crash. **Recommendations** Update GPAC to the version containing commit b35c61f104b85fbb16520ac2838d5d2ef70845b5.

**Name of the Vulnerable Software and Affected Versions** GPAC versions prior to commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 **Description** A buffer overflow allows an attacker to cause a denial of service. This issue occurs within the `src/scenegraph/svg attributes.c` file, specifically involving the `svg parse strings()` and `gf svg parse attribute()` functions. **Recommendations** Update to the version containing commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702. As a temporary workaround, restrict the use of the `svg parse strings()` and `gf svg parse attribute()` functions.