Luca Moro

This issue allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this issue. The specific flaw exists within the `dsi writeinit` function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this issue to execute code in the context of root.

A flaw was found in Samba, where some SMB1 write requests were not correctly range-checked, allowing server memory contents to be written into the file or printer instead of client-supplied data. The client cannot control the area of the server memory written to the file or printer. This issue may allow a remote attacker to cause a denial of service.

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting this combination of primitives, an attacker can execute arbitrary code.

A bug in the pf component of FreeBSD does not properly check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet. This allows a maliciously crafted ICMP/ICMP6 packet to bypass packet filter rules and be passed to a host that would otherwise be unavailable.

The issue is related to insufficient input validation in the PF IPv6 firewall. It can be exploited by a remote attacker using a specially crafted IPv6 packet, potentially allowing them to bypass existing access control policies or cause a denial of service. The problem lies in the incorrect handling of the last extension header offset from the last received packet instead of the first packet in the pf IPv6 fragment reassembly logic.