Liyansong2018

The issue concerns arbitrary address read vulnerabilities in the `readelf` component of ToaruOS when it parses a crafted ELF file.

The issue allows for remote code execution when a crafted ELF file is parsed, due to a global overflow in the readelf component.

A heap-buffer overflow issue was discovered in Luadec via the `UnsetPending` function.

The issue is related to a memory leak in the Unicorn Engine, which occurs via the `uc close` function located at `/my/unicorn/uc.c`.

A use-after-free issue was found in the hook function of the Unicorn Engine.

A NULL pointer dereference issue was discovered via `qemu ram free`.

The issue is caused by an incomplete unicorn engine initialization, leading to memory leaks.

The issue is related to an out-of-bounds read bug in the ELF file format analysis. This bug can cause application crashes or information leakage. By constructing a specially formatted ELF file, it is possible to leak information from any address.

The issue is related to Incorrect Access Control in the D-Link DIR-2640-US router. When setting up PPPoE, the router starts the quagga process, which uses the default password and port, allowing an attacker to easily log in using telnet. This enables the attacker to modify routing information, monitor traffic of all devices under the router, hijack DNS, and conduct phishing attacks. The interface in question may be perceived as a backdoor due to its exposure.

The issue allows for Cross Site Request Forgery (CSRF) attacks. Since all configuration information is placed in the URL without additional token authentication, a malicious link opened by the switch administrator can lead to the modification of the switch's password and tampering with the configuration file.

The issue is caused by an Array index error in the interface that provides the device description function. This function only checks the length of the received data and does not filter special characters, leading to a crash of the application and erasure of all device configuration information.

The issue is related to insufficiently protected credentials. The D-Link AC2600 (DIR-2640) stores the device system account password in plain text and does not utilize Linux user management. Furthermore, all devices have the same password, which cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges.