Marco Ivaldi

An incorrect permission assignment vulnerability in the PostgreSQL commands could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.

The issue arises from missing parameter checks in the `xQueueCreate()` and `xQueueCreateSet()` functions from the FreeRTOS compatibility API. This could lead to integer wraparound, under-allocations, and heap buffer overflows.

The issue is related to a missing array size check in the ` Mtxinit()` function within the Xtensa port of Eclipse ThreadX, causing a memory overwrite. The affected file is `ports/xtensa/xcc/src/tx clib lock.c`.

The issue arises when an attacker can control parameters of the ` portable aligned alloc()` function, potentially causing an integer wrap-around and an allocation smaller than expected. This could lead to subsequent heap buffer overflows.

A stack buffer overflow occurs in the net/at/src/at server.c file.

An out-of-bounds access occurs in utilities/var export/var export.c.

A stack buffer overflow occurs in the libc/posix/ipc/mqueue.c file.

A heap buffer overflow occurs in finsh/msh file.c and finsh/msh.c.

The issue is related to a weak random number generation algorithm used in RT-Thread. The algorithm, defined as `seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;`, is implemented in the `calc random` function within the `drivers/misc/rt random.c` file. This weakness can potentially lead to predictable random numbers.

The issue is related to an integer signedness error and resultant buffer overflow in the `drivers/wlan/wlan mgmt,c` component.

A buffer overflow occurs in the utilities/rt-link/src/rtlink.c file.

A heap buffer overflow occurs in the dfs v2 romfs filesystem.

A heap buffer overflow occurs in `dfs v2 dfs file` in RT-Thread.

A buffer overflow occurs in utilities/ymodem/ry sy.c because of an incorrect sprintf call or a missing '0' character.

The issue is related to a bug in the parser of lpstat, an external command invoked by dtprintinfo, which occurs during the listing of available printer names. This bug allows low-privileged local users to inject arbitrary printer names via the $HOME/.printers file, enabling them to manipulate control flow and disclose memory contents on Solaris 10 systems. It's noted that this vulnerability only affects products that are no longer supported by the maintainer.

A stack-based buffer overflow in the `ParseColors` function in `libXm` can be exploited by local low-privileged users via the `dtprintinfo` setuid binary to escalate their privileges to root on Solaris 10 systems. This issue only affects products that are no longer supported by the maintainer.

The issue is related to a flaw in the libXpm library, specifically in the `ParseComment()` function, which can lead to an infinite loop when parsing a file with an unclosed comment. This can result in a Denial of Service (DoS) in the application linked to the library. The vulnerability can be exploited by a remote attacker using a specially crafted XPM file.

The issue is related to multiple improper input validation flaws in some CLI commands of Zyxel network device firmware, which could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload. This is due to insufficient input validation, allowing an attacker to exploit the vulnerability and potentially cause a denial of service.

A local authenticated attacker could execute arbitrary OS commands by including crafted arguments to the 'packet-trace' CLI command due to an argument injection vulnerability. This vulnerability is related to the lack of measures to neutralize special elements used in the OS command.

The issue is related to a lack of protection for service data in the Whodo component of Oracle Solaris. It allows a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The attacks can result in unauthorized read access to a subset of Oracle Solaris accessible data.