Pali Rohár

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A buffer overflow issue has been identified in the Linux kernel when parsing NFS reparse points. The problem arises because the function `cifs strndup from utf16()` accesses the `DataBuffer` beyond its bounds due to not subtracting the `InodeType` size from the `ReparseDataLength`. To fix this, the code now correctly subtracts the `InodeType` size from the `ReparseDataLength` to prevent accessing memory beyond the buffer's end. Additionally, checks have been added to ensure that `InodeType` and major and minor `rdev` values are only accessed when the reparse buffer is sufficiently large, preventing invalid memory accesses. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the buffer overflow issue when parsing NFS reparse points. As a temporary workaround, consider restricting access to the `cifs strndup from utf16()` function until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the PCI: aardvark component in the Linux kernel, where starting a new PIO transfer by writing value 0 in the PIO START register when the previous transfer has not yet completed causes an External Abort on the CPU, resulting in a kernel panic. This happens because the kernel may issue a new PIO request while the previous one has not finished, especially during link retraining or after a link down event, which can take up to 1.44 seconds to time out. To prevent kernel panic, it is required to reject a new PIO transfer when the previous one has not finished yet. The kernel may issue a new PIO request only if the previous PIO transfer timed out. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Email::Address module versions through 1.909 **Description** The issue concerns the parse() method in the Email::Address module, which is susceptible to algorithmic complexity when processing specially prepared input. This can lead to a Denial of Service. The problematic input contains 30 form-field characters (`f`). **Recommendations** For Email::Address module versions through 1.909, consider restricting the use of the parse() method until a patch is available. As a temporary workaround, avoid using the parse() method with untrusted input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** UDFclient versions prior to 0.8.8 **Description** The issue is related to a buffer overflow in the custom strlcpy implementation used by UDFclient. This implementation is utilized on systems where the C library, such as glibc, does not have its own strlcpy. **Recommendations** For versions prior to 0.8.8, update to version 0.8.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle MySQL versions 5.5.55 and earlier Oracle MySQL versions 5.6.35 and earlier **Description** The issue allows a low-privileged attacker with network access via multiple protocols to compromise the MySQL Server, potentially resulting in unauthorized access to critical data or complete access to all MySQL Server accessible data. It is difficult to exploit and requires a high level of access. Successful attacks can also cause a hang or complete denial of service (DOS) of the MySQL Server. **Recommendations** For Oracle MySQL versions 5.5.55 and earlier, update to a version later than 5.5.55 to resolve the issue. For Oracle MySQL versions 5.6.35 and earlier, update to a version later than 5.6.35 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Email-Address module versions 1.908 and earlier **Description** The issue allows remote attackers to cause a denial of service due to high CPU consumption. This can be achieved by sending a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. **Recommendations** For Email-Address module versions 1.908 and earlier, consider updating to a version later than 1.908 to resolve the issue. As a temporary workaround, consider restricting the use of nested comments in conjunction with parenthesis characters to minimize the risk of exploitation.