Junyi Liu

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission.

An improper link resolution before file access, also known as link following, allows a remote attacker with a user account to compromise system security. This issue occurs during the VM import process and involves path traversal, which is a technique used to access files and directories that are stored outside the intended folder.

On Windows Container on Windows (WCOW) workers, the cache mount `source=` selector fails to detect NTFS directory junctions located within the cache root. This allows an untrusted user to author a build that can read arbitrary host files accessible to the BuildKit daemon process.

An out-of-bounds read occurs in the VA JPEG decoder within the gst-plugins-bad module. The JPEG parser reads a segment length value from the bitstream without validating it against the available data. A remote attacker can exploit this by inducing a user to open a specially crafted JPEG file, which causes the parsing process to read beyond the input buffer, potentially resulting in a crash or information disclosure.

A heap buffer overflow exists in the librfb (RFB/VNC client) component of GStreamer. The issue occurs because the rectangle bounds check validates the total area instead of individual dimensions. This allows a malicious VNC server to send a rectangle that extends beyond the framebuffer, leading to an out-of-bounds heap write. A remote attacker could exploit this by tricking a user into connecting to a malicious VNC server, potentially resulting in code execution or a system crash.

Multiple out-of-bounds read issues exist in the `pcapparse` element. Malformed PCAP records can trigger reads beyond buffer boundaries during the parsing of IPv4 and TCP headers. A local attacker could induce a user to process a specially crafted PCAP file, which may result in information disclosure or a system crash. This element is mainly utilized in debugging pipelines.

A signed integer overflow exists in the VMnc decoder. A specially crafted VMnc stream containing large cursor dimensions can cause an overflow in signed integer payload-size arithmetic. This allows the bypass of a length check, resulting in out-of-bounds reads, which occur when a program reads data past the end of the intended buffer. A remote attacker could exploit this by tricking a user into opening a malicious VMnc file, potentially leading to information disclosure or a system crash.

A denial of service issue exists in the AV1 codec parser within gst-plugins-bad. The `gst av1 parser parse tile list obu()` function incorrectly passes a byte count to a bit-reader API that expects a bit count, leading to parser desynchronization. A remote attacker can cause the application to crash via an assertion abort by tricking a user into opening a specially crafted AV1 media file.