Mobasi-Team

Name of the Vulnerable Software and Affected Versions Unfurl versions through 2025.08 Description Unfurl through 2025.08 has an improper input validation issue in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to `app.run()`, causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and potentially disclose sensitive information or achieve remote code execution. Recommendations Update to a version later than 2025.08.

Name of the Vulnerable Software and Affected Versions Unfurl versions prior to 2026.04 Description Unfurl contains a flaw in the `parse compressed.py` component due to unbounded zlib decompression. Remote attackers can leverage this to cause a denial of service. Specifically, attackers can send large, compressed payloads through URL parameters to the `/json/visjs` API endpoint. These payloads expand to gigabytes, consuming server memory and leading to service crashes. Recommendations Update to version 2026.04 or later.

tcpflow is a TCP/IP packet demultiplexer. The software parses 802.11 management frame elements and performs a length check on an incorrect field when handling the TIM (Timing Advertisement) element. A specially crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past `tim.bitmap[251]`. The overflow is small, and a denial-of-service (DoS) attack is the likely impact, although code execution is possible. The affected structure is allocated on the stack within the `handle beacon()` function and related handlers.

`bulk extractor` is a digital forensics exploitation tool. The embedded unrar code within `bulk extractor`, starting with version 1.4, contains a heap-buffer-overflow in the RAR PPM LZ decoding path. A specially crafted RAR archive within a disk image can trigger an out-of-bounds write in the `Unpack::CopyString` function, resulting in a crash. This could potentially lead to remote code execution.