Luiginoc

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-22 **Description** An information disclosure issue exists in the `PasskeyEncipherImage()` method. The flaw is caused by the reuse of a nonce (a unique number used once) in the AES-CTR cipher implementation. This allows attackers to recover plaintext information from encrypted images. **Recommendations** Update to version 7.1.2-22 or later.

**Name of the Vulnerable Software and Affected Versions** CryptoLib versions prior to 1.4.3 **Description** CryptoLib is a software solution that uses the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. Prior to version 1.4.3, the `base64urlDecode` function contains a flaw where padding-stripping dereferences input data before verifying its validity. Specifically, it accesses `input[inputLen - 1]` before confirming that `inputLen` is greater than zero or that `input` is not NULL. If `inputLen` is zero, this results in an out-of-bounds read at `input[-1]`, potentially causing the process to crash. If `input` is NULL and `inputLen` is zero, a dereference of NULL - 1 occurs. **Recommendations** Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.23.0 **Description** FreeRDP is a free implementation of the Remote Desktop Protocol. A buffer overread exists in the `freerdp image copy from icon data()` function (libfreerdp/codec/color.c). This issue can be triggered by specially crafted RDP Window Icon (TS ICON INFO) data. The flaw is reachable over a network when a client processes icon data from an RDP server, or in a man-in-the-middle scenario. **Recommendations** Update to version 3.23.0 or later.

**Name of the Vulnerable Software and Affected Versions** CryptoLib versions prior to 1.4.2 **Description** CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) for secure communications between spacecraft and ground stations. A command injection issue exists in the `initialize kerberos keytab file login()` function due to the direct interpolation of user-controlled input into a shell command executed via the `system()` function without proper sanitization or validation. This allows for potential unauthorized command execution. **Recommendations** Update CryptoLib to version 1.4.2 or later.