Quang Nguyen

The issue is related to a stack-based buffer overflow when handling the `var:page` parameter provided to the "webproc" endpoint. This occurs due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to a stack-based buffer overflow when handling the `var:menu` parameter provided to the "webproc" endpoint. This occurs due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. No authentication is required to exploit this vulnerability.

The issue is related to a heap-based buffer over-read in Fill IMA ADPCM block, caused by an integer overflow in the `IMA ADPCM decode()` function in audio/SDL wave.c. This can be exploited by a remote attacker using a specially crafted file, potentially leading to a denial of service.

The issue is related to an integer overflow in the `AllocateDataSet` function in `cmscgats.c`, which leads to a heap-based buffer overflow in the `SetData` function. This can be triggered via a crafted file passed as the second argument to `cmsIT8LoadFromFile`, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code.