Kevin Backhouse

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 25.06.0 Description: The issue is related to the use of `std::atomic int` for reference counting in the Poppler PDF rendering library. Since `std::atomic int` is only 32 bits, it is possible to overflow the reference count, which can trigger a use-after-free. Recommendations: For versions prior to 25.06.0, update to version 25.06.0 to resolve the issue.

An unprivileged local attacker can trigger a use-after-free issue in accountsservice by sending a D-Bus message to the accounts-daemon process. This allows the attacker to potentially exploit the vulnerability.

A vulnerability in the `pki verify data signature` function of the libssh library for client authentication is related to shortcomings in the authentication procedure. This issue may allow a remote attacker to bypass security restrictions and gain unauthorized access to protected information. The problem is caused by the return value `rc`, which is initialized to SSH ERROR and later rewritten to save the return value of the function call `pki key check hash compatible`. The value of the variable is not changed between this point and the cryptographic verification. Therefore, any error between them calls `goto error` returning SSH OK.

The issue is related to the function that splits the command arguments into an array in Git's `git shell`, which improperly uses an `int` to represent the number of entries in the array. This allows a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes and potentially gaining remote code execution on a victim machine. The victim must first allow access to `git shell` as a login shell to be vulnerable to this attack.

The issue is related to the `nfs lookup reply` function in `net/nfs.c`, which is part of the U-Boot bootloader for Linux-based embedded operating systems. It involves a buffer copy operation without proper input size validation, potentially leading to a buffer overflow. This could allow an attacker to execute arbitrary code.

The issue is related to a double-free memory corruption error in the accountsservice component of the Ubuntu operating system. This error occurs due to the fallback locale variable being freed in the user change language authorized cb function, which is reachable via the `SetLanguage` dbus function. The exploitation of this issue can allow an attacker to locally elevate privileges to root.

The issue is related to a Regular Expression Denial of Service (ReDoS) vulnerability in the `email regex` of Flask-RESTX. This vulnerability can be exploited, potentially leading to a denial of service.

The issue is related to an infinite loop triggered when Exiv2 is used to read the metadata of a crafted image file. This could potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The vulnerability allows a remote attacker to cause a denial of service using a specially crafted image file.

The issue is related to an infinite loop in the Exiv2 library, which can be triggered when modifying the metadata of a crafted image file. This can potentially allow an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is specifically triggered when deleting the IPTC data, which requires an extra command line option (`-d I rm`).

The issue is related to an infinite loop in the Exiv2 library, which can be triggered when printing the metadata of a specially crafted image file, potentially allowing a remote attacker to cause a denial of service. This bug is specifically triggered when printing the image ICC profile, a less frequently used operation that requires the extra command line option `-p C`.

The issue is related to an out-of-bounds read in the Exiv2 library, which can be triggered when reading the metadata of a specially crafted image file. This could potentially allow a remote attacker to cause a denial of service. The library is used for managing metadata of image files.

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this issue is to data confidentiality and integrity as well as system availability. The `polkit system bus name get creds sync()` function of the dbus-daemon library is associated with insufficient access control, allowing an attacker to elevate their privileges.

The issue is related to integer overflows and underflows in the apt package manager while parsing .deb packages. This can be exploited to gain access to confidential data, disrupt data integrity, and cause a denial of service. The affected files are apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc.

The issue is related to memory and file descriptor leaks found in the python-apt module, specifically in the files python/arfile.cc, python/tag.cc, and python/tarfile.cc. This can lead to a denial of service. The leaks are caused by the lack of resource release after its expiration.

Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges.

The aptdaemon DBus interface disclosed file existence by setting Terminal/DebconfSocket properties.

The issue allows a local user to potentially create a new privileged account on Ubuntu and its derivatives by exploiting a vulnerability in the GNOME Display Manager (GDM) when it cannot contact the accountservice service via dbus in a timely manner. This can be chained with another issue to achieve privilege escalation. The vulnerability is resolved in GNOME 3.36.2 and 3.38.2.

The issue is related to an out-of-bounds read in the SANE Backends interface, which provides access to scanning devices. This may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program.

The issue is related to an out-of-bounds read that may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program. This could potentially provide access to confidential data.

The issue is related to a NULL pointer dereference in the `sanei epson net read` function of the SANE Backends interface, which provides access to raster image scanning devices. This can be exploited by a malicious device connected to the same local network as the victim, allowing the attacker to cause a denial of service.