Medoedus

A blind Server-Side Request Forgery (SSRF) exists when the `[oauth2 client] UPDATE AVATAR = true` setting is enabled. The issue occurs because the server fetches the avatar URL provided by an OAuth2/OIDC provider—typically the `picture` claim—using the default Go HTTP client without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim can force the Gitea server to make arbitrary outbound HTTP GET requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`. Technical details include: - **Vulnerable Function**: `oauth2UpdateAvatarIfNeed()` in `routers/web/auth/oauth.go` and `oauth2SignInSync()` in `routers/web/auth/oauth signin sync.go`. - **Vulnerable Variable**: `gothUser.AvatarURL`. While the issue is primarily blind because non-image responses are rejected, the impact increases if the server can reach cloud metadata services or internal services that return valid image data, which could then be stored as the user's avatar.

An issue exists in the token public-only scope enforcement where a public-only scoped API token can access private organization data. This occurs due to two flaws: the endpoint '/user/orgs' is missing the `checkTokenPublicOnly()` validation, and the `checkTokenPublicOnly()` function uses a switch-case logic that only evaluates the first matching category, causing the user visibility check to be skipped for routes involving both user and organization categories.

OpenImageIO is a toolset for reading, writing, and manipulating image files for VFX and animation. An issue exists in `jpeg2000input.cpp` where the buffer size is computed using signed 32-bit arithmetic via the calculation `const int bufsize = w * h * ch * buffer bpp`. If the resulting product exceeds `INT MAX`, the value wraps to zero or a small number, causing `m buf.resize()` to allocate an undersized buffer. This leads to a heap overflow during subsequent pixel write loops. This issue is conditional on the `USE OPENJPH` build flag.

An issue exists in the toolset used for reading, writing, and manipulating image files for VFX and animation. Specifically, the `softimageinput.cpp` file fails to clamp the run length to the remaining scanline width before writing pixels in both mixed RLE (Run-Length Encoding, a form of lossless data compression) and pure RLE paths. While the raw packet path uses `std::min` for clamping, the RLE paths bypass this check. A specially crafted .pic file can trigger a heap overflow of up to 65535 bytes.

OpenImageIO is a toolset for reading, writing, and manipulating image files for VFX and animation. A heap buffer overflow and crash can occur when processing a crafted .sgi file where the RLE (Run-Length Encoding) count exceeds the scanline width. This happens because the `sgiinput.cpp` file uses `OIIO DASSERT` for bounds checking in the RLE decode loop; in release builds, this macro is compiled as a no-op, effectively disabling the bounds checks.

An off-by-one error exists in the path traversal filter within `channels/drive/client/drive file.c`. The `contains dotdot()` function fails to detect `..` when it is the final component of a path without a trailing separator, although it correctly identifies `../` and `..` mid-path. A malicious RDP server can exploit this to read, list, or write files one directory above the client's shared folder via RDPDR requests, provided the client connects with drive redirection enabled.

An integer overflow exists in the `ImageChannel::resize()` function, which can lead to a heap out-of-bounds (OOB) write—a condition where data is written outside the boundaries of the allocated memory buffer—via the OpenEXRUtil public API.