Philippe Laulheret

The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command to provide camera connection details, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers. This occurs through manual byte-by-byte loops, potentially leading to a buffer overflow, specifically within the password field when no key is present.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the `2wayAudio` command.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software such as GV-VMS and GV-Cloud. It establishes a websocket server to enhance the functionality of web interfaces. The software contains an out-of-bounds read issue triggered by the pause command index-out-of-bound.

GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, including the `connectionInfo` command used to provide camera connection details. The associated function `handle connection info` contains multiple string copy operations that can overflow. Specifically, the function copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that fail to enforce length limits, leading to a stack-based buffer overflow in the username field.

The GeoWebPlayer addon, which creates a websocket server to expand web-interface capabilities for GeoVision software, contains a memory corruption issue. The `handle connection info` function fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops. This occurs specifically when processing the `connectionInfo` command, particularly within the password field.

GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, including the `connectionInfo` command used to provide camera connection details. The associated `handle connection info()` function contains multiple string copy operations that can overflow. Specifically, the function copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that fail to enforce length limits, leading to a stack-based buffer overflow in the `ip` field.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that implements a websocket server to extend web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. A lack of range validation for the `index` parameter allows out-of-bounds access to multiple arrays. Specifically, when the `saveVideo` command is used, the `index` value is used to trigger and release a CriticalSection (a synchronization mechanism used to prevent multiple threads from accessing a shared resource simultaneously). The release process involves a function pointer read from an out-of-bounds memory location, which could potentially lead to arbitrary code execution.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the `setPIP` command.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the snapshot command.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the play command.

The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops. This can lead to a buffer overflow, specifically when processing the `username` field.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the disconnect command.

The GeoWebPlayer websocket server, used as an addon for GeoVision software such as GV-VMS and GV-Cloud, contains a memory corruption issue. The `handle connection info` function, which processes the `connectionInfo` command, fails to enforce length limits when copying attacker-controlled JSON strings into fixed-size buffers. This occurs through manual byte-by-byte loops, specifically affecting the key field, which can lead to a buffer overflow.

GeoWebPlayer, also known as Web Plugin or WS Player, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server does not require authentication, allowing malicious websites to establish connections and access sensitive APIs. An attacker can use a combination of the `create` method and the `getScreenCapture` method to capture and retrieve the content of the user's screen.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the audio command.

The GeoWebPlayer addon, which functions as a websocket server for GeoVision software such as GV-VMS and GV-Cloud, contains an out-of-bounds array access flaw. The server accepts commands from localhost that utilize an `index` value to access arrays for critical sections and function calls. Because the `index` value is not properly validated for range, it can be used to access arrays outside their intended boundaries, specifically within the `connectInfo` command.

GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost, several of which utilize an `index` value to access arrays for critical sections or function calls. Because the `index` value is not validated for a correct range, it can be used to perform out-of-bounds access on multiple arrays, specifically within the `setStream` command.

The DVRSearch service, which runs by default and listens for UDP messages on port 10001, contains a stack-based buffer overflow. The issue occurs when the server reads up to 1460 bytes into a local buffer and subsequently performs an unsafe copy of the configured DNS address into a reply buffer using `memcpy()` with a length derived from `strlen()`. An unauthenticated network attacker can send crafted UDP traffic to trigger this overflow, potentially leading to remote code execution and full compromise of confidentiality, integrity, and availability.

OS command injection flaws exist in the `libNetSetObj.so` internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially crafted network packet. Specifically, the `m F n Set Net Mask()` function fails to sanitize the `netmask addr` variable before passing it to a system call. This issue is reachable via the `Network.cgi` endpoint and the `DVRSearch` service.