Luigino Camastra

A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the `SSL set SSL CTX()` function to switch a connection to a different SSL CTX during a handshake. This occurs if the replacement context recognizes more provider signature algorithms than the original context used to create the connection, as the internal array of per-slot certificate validity flags is not refreshed. A remote peer can trigger this by offering multiple signature algorithms, potentially corrupting heap metadata and causing a Denial of Service. This issue specifically affects provider signature algorithms usable from TLS 1.3.

A null pointer dereference occurs in the kernel driver's Fast I/O device control handler due to a failure to validate the volume context before use. An unprivileged local user can cause a system crash and denial of service by opening the WinFsp control device and issuing `FSP IOCTL TRANSACT` requests.

A flaw in the TTL file parser can lead to an infinite loop, resulting in a denial of service.

A double-free issue exists in the `parse def()` function within `src/conf.c`. This occurs when the system parses nested compound or array configuration blocks and fails to check return values before proceeding. Consequently, the `snd config delete()` function is called twice on the same already-freed node, which can lead to memory corruption, a NULL-pointer write, or an invalid memory read if an attacker provides maliciously crafted ALSA configuration text.

Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling.

A read out of bounds issue exists in wolfSSHd on Windows when handling a terminal resize request. An authenticated user can trigger this condition after establishing a connection, resulting in the leakage of adjacent stack memory to the pseudo-console output.

The software contains a Relative Path Traversal and Improper Isolation or Compartmentalization issue. The issue is associated with program files `lib/tftp/src/tftp file.erl` and `src/tftp file.erl`. The vulnerability affects the `tftp file` modules within erlang/otp, inets, and tftp.

A heap buffer over-read issue exists in the `wolfSSH CleanPath()` function within wolfSSH. A remote attacker with authentication can trigger this by providing specially crafted SCP path input that includes '/./' sequences. This results in a heap over-read of 1 byte.

An invalid or NULL pointer dereference can occur in applications processing malformed PKCS#12 files. This can lead to a denial of service when an application attempts to read from an invalid or NULL pointer in memory. The issue stems from a type confusion in the PKCS#12 parsing code, where an ASN1 TYPE union member is accessed without prior type validation, resulting in an invalid pointer read. The vulnerability is constrained to a 1-byte address space, which typically results in a crash due to unmapped memory on modern operating systems. Exploitation requires processing a maliciously crafted PKCS#12 file.

A type confusion issue exists in the signature verification of signed PKCS#7 data. This occurs when an ASN1 TYPE union member is accessed without first validating the type, potentially leading to an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Exploiting this requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of exploitation is a denial-of-service. The vulnerable code is within the `PKCS7 digest from attributes()` function, which accesses the message digest attribute value without validating its type. This can result in accessing invalid memory through the ASN1 TYPE union, causing a crash. The PKCS7 API is considered legacy, and applications should use the CMS API instead.

The server previously verified the TLS 1.3 PSK binder using a non-constant time method, which could potentially leak information about the PSK binder. The TLS 1.3 PSK binder is a cryptographic element used to establish a secure connection. A non-constant time verification method can be exploited to reveal information about the binder, potentially compromising the security of the connection.

An integer underflow can lead to out-of-bounds access during decryption using XChaCha20-Poly1305. This occurs specifically when calling the `wc XChaCha20Poly1305 Decrypt()` function, which is utilized by direct application calls and not through TLS connections.

A malformed PKCS#12 file can cause a NULL pointer dereference in the `PKCS12 item decrypt d2i ex()` function. This can lead to a denial of service, causing an application crash when processing PKCS#12 files. The issue occurs because the `PKCS12 item decrypt d2i ex()` function does not validate if the `oct` parameter is NULL before dereferencing it. When called from `PKCS12 unpack p7encdata()` with a crafted PKCS#12 file, this parameter can be NULL, resulting in a crash. The vulnerability is limited to denial of service and cannot be used for code execution or memory disclosure. Exploitation requires an attacker to provide a malformed PKCS#12 file to an application that processes it.

The issue is related to a Denial of Service (DoS) condition that can be triggered by a specially crafted HTTP request, potentially causing the service to crash. It is also described as a "Coffee Overflow" in the context of the FortiCup Administrative Interface, though the exact nature of this overflow is not specified. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to a privilege escalation bug in the Windows Ancillary Function Driver (AFD.sys) for WinSock. It has been actively exploited by the Lazarus Group, a North Korea-linked APT group, to gain SYSTEM privileges on the latest Windows operating systems. The vulnerability allows attackers to manipulate kernel structures, gaining read and write access. It is a use-after-free flaw in the AFD.sys driver, which is installed by default on all Windows devices, making it a significant threat. The estimated number of potentially affected devices worldwide is not specified, but it is considered a major threat due to the widespread use of Windows devices.

The issue is related to an elevation-of-privilege vulnerability in the Win32k component of Windows operating systems. This vulnerability is associated with errors in processing objects in memory. Exploitation of this vulnerability can allow an attacker to elevate their privileges. The vulnerability can be exploited by opening a specially crafted RTF file, which can lead to local privilege escalation (LPE) to system level. There have been reports of this vulnerability being actively exploited in the wild.