Oblivionsage

The `phar tar number()` function parses the octal size field of a TAR header into a `uint32 t` without an overflow check. Because the field is 11 octal digits wide and can hold values up to 0x1FFFFFFFF, any size exceeding 0xFFFFFFFF silently wraps. This causes the parser to skip an incorrect number of data blocks and interpret attacker-controlled file content as the subsequent TAR header, allowing a crafted archive to inject entries that PharData reports and extracts as genuine.

A null pointer dereference (a condition where a program attempts to read from a memory address that is null, typically causing a crash) can be triggered remotely in the Bot API component. The issue exists within the `RequestButton()` function located in the `Telegram/SourceFiles/boxes/url auth box.cpp` file, specifically through the manipulation of the `login url` argument.

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 Description Rack’s `Rack::Files#fail` function incorrectly calculates the `Content-Length` response header using `String#size` instead of `String#bytesize`. This occurs when the response body contains multibyte UTF-8 characters, resulting in a declared `Content-Length` smaller than the actual number of bytes sent. An attacker can trigger this by requesting a non-existent path with percent-encoded UTF-8 characters, leading to incorrect HTTP response framing and potential response desynchronization. The `Rack::Files` component reflects the requested path in 404 responses, which contributes to the issue when handling requests with multibyte characters. This can cause inconsistencies in response parsing or desynchronization, particularly in deployments with keep-alive connections and intermediaries relying on the `Content-Length` header. Recommendations Update to Rack version 2.2.23 or later. Update to Rack version 3.1.21 or later. Update to Rack version 3.2.6 or later.

User-controlled `chunkSize` metadata lacks appropriate validation, potentially leading to malformed GridFS metadata overflowing the bounding container. This can result in a heap allocation failure during file handling.

LIBPNG is a library used by applications to read, create, and manipulate PNG raster image files. Versions 1.2.1 through 1.6.55 contain an issue where the `png set tRNS` and `png set PLTE` functions alias a heap-allocated buffer between `png struct` and `png info`, sharing a single allocation across two structures with independent lifetimes. This aliasing has been present since at least libpng 1.0 for `trans alpha` and since at least 1.2.1 for `palette`. When `png free data` is called with `PNG FREE TRNS` or `PNG FREE PLTE`, the buffer is freed through `info ptr` while the corresponding `png ptr` pointer remains dangling. Subsequent row-transform functions may then dereference and write to this freed memory. Calling `png set tRNS` or `png set PLTE` a second time has the same effect, as these functions call `png free data` internally before reallocating the `info ptr` buffer.

A flaw exists in QEMU where a specifically designed VMDK image can cause an out-of-bounds read. This could result in a leak of up to 12 bytes of sensitive information or a denial of service.

A path traversal vulnerability exists in Node.js when running on Microsoft Windows. The `path.normalize()` function fails to block Windows device names such as CON, PRN, and AUX, allowing attackers to exploit this behavior for path traversal attacks. The vulnerability leverages the specific way Windows handles reserved device filenames.