Sebasteuo

**Name of the Vulnerable Software and Affected Versions** eml parser versions prior to 3.0.2 **Description** The `clean found uri()` function in `eml parser/parser.py` validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. This causes valid encoded URLs and their host names to be rejected and omitted from extracted URL and domain lists. Consequently, security gateways and SOC pipelines relying on these lists as indicators of compromise may fail to submit hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection. **Recommendations** Update to version 3.0.2.

**Name of the Vulnerable Software and Affected Versions** eml parser versions prior to 3.0.2 **Description** The `noparenthesis` function in `eml parser/routing.py` uses a regex-based fix-point loop to remove parenthesized CFWS (Comments and Folding White Space) from Received: headers. The processing time for this operation is quadratic relative to the nesting depth of the parentheses. An attacker can provide small EML files with deeply nested parentheses to cause high CPU saturation, leading to worker latency, queue backpressure, and potential service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. **Recommendations** Update to version 3.0.2.

**Name of the Vulnerable Software and Affected Versions** eml parser versions prior to 3.0.2 **Description** The `header fetch parse()` function within the `eml parser.parser.HeaderParser` module uses `email.utils.getaddresses()` to parse address-bearing e-mail headers. A deeply nested CFWS (Comments and Folding White Space) comment construct can exhaust the recursive descent parser's call stack in the standard library, triggering a `RecursionError`. Because this error is not caught, it aborts the parsing of the entire message, allowing an attacker to disrupt SOC (Security Operations Center) pipelines that process untrusted EML files. **Recommendations** Update eml parser to version 3.0.2.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** An out-of-bounds read occurs in the NI grpc-device streaming API because of a missing bounds check. This issue can lead to a denial of service if an attacker provides a specially crafted write request. **Recommendations** Update NI grpc-device to a version later than 2.17.0.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** An untrusted pointer dereference exists in the sideband streaming API. This issue allows an attacker to trigger an arbitrary memory dereference, which could lead to remote code execution. Exploitation is possible by providing a specially crafted `Moniker` protobuf message. **Recommendations** Update to a version later than 2.17.0.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** A NULL pointer dereference occurs in the data moniker service of NI grpc-device. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically resulting in a program crash. An attacker can cause a denial of service by providing an unknown value to the data moniker service. **Recommendations** Update to a version later than 2.17.0.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** An unchecked enum cast issue exists in the `BeginSidebandStream` function. An attacker can trigger invalid enum states and undefined behavior by supplying a specially crafted message containing an out-of-range value, which may lead to a denial of service. **Recommendations** Update to a version later than 2.17.0.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** A memory leak exists in the `BeginSidebandStream()` function, which can lead to a denial of service condition caused by memory exhaustion. **Recommendations** Update to a version later than 2.17.0. As a temporary workaround, restrict the use of the `BeginSidebandStream()` function to minimize the risk of memory exhaustion.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** Insecure default credentials exist when TLS configuration is absent and the server is bound beyond the loopback interface. This allows an unauthenticated user on the local network to gain access to the server, potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on a remote machine. **Recommendations** Update to a version later than 2.17.0.

**Name of the Vulnerable Software and Affected Versions** NI grpc-device versions prior to 2.17.0 **Description** An incorrect conversion between numeric types occurs in NI grpc-device due to missing range checks in CodeGen. This issue may result in the silent discarding of high bits if a size value exceeds the range of the target type. **Recommendations** Update NI grpc-device to version 2.17.0 or later.

**Name of the Vulnerable Software and Affected Versions** eml parser version 3.0.0 **Description** A recursion denial of service exists in the `get raw body text()` function within `eml parser/parser.py`. The function recurses unconditionally for every nested `message/rfc822` attachment without a depth limit. An attacker can provide a specially crafted EML file with approximately 120 nested `message/rfc822` parts to trigger an unhandled `RecursionError`, which aborts the parsing process and can crash a worker process. This issue is exploitable in deployments that ingest emails from external senders without basic validation. **Recommendations** Update eml parser to a version where recursion depth checks have been implemented for the `get raw body text()` function.

**Name of the Vulnerable Software and Affected Versions** Eclipse Open9J versions 0.21 through 0.58 **Description** A pre-authentication remote attacker can cause the JITServer to crash by sending a specifically crafted 32-byte TCP message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions openFPGALoader versions 1.1.1 and earlier Description A heap-buffer-overflow read issue exists in the `POFParser::parseSection()` function when processing a specially crafted .pof file. This allows out-of-bounds heap memory access. No FPGA hardware is needed to trigger this issue. Recommendations Update to a version later than 1.1.1.

Name of the Vulnerable Software and Affected Versions openFPGALoader versions 1.1.1 and earlier Description openFPGALoader is a utility for programming FPGAs. A heap-buffer-overflow read vulnerability exists in the `BitParser::parseHeader()` function when parsing a crafted .bit file, allowing out-of-bounds heap memory access. No FPGA hardware is required to trigger this issue. Recommendations Update to a version later than 1.1.1.

Name of the Vulnerable Software and Affected Versions SDL image (affected versions not specified) Description The SDL image library has an issue where pixel index values from decoded XCF tile data are used directly as colormap indices without validation against the colormap size. A crafted .xcf file with a small colormap and out-of-range pixel indices can cause heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, potentially making them observable in the rendered image. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.24.2 **Description** FreeRDP is a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol (RDP) server can cause a FreeRDP client to crash by sending audio data in IMA ADPCM format with an invalid initial step index value (greater than or equal to 89). The unvalidated step index is read directly from the network and used to index into a lookup table, triggering a failure and process termination. This affects any FreeRDP client with audio redirection (RDPSND) enabled, which is the default configuration. **Recommendations** Update to FreeRDP version 3.24.2 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.24.2 **Description** FreeRDP is a free implementation of the Remote Desktop Protocol. An unvalidated `auth length` field read from the network triggers a WINPR ASSERT() failure in the `rts read auth verifier no checks()` function, causing FreeRDP clients connecting through a malicious RDP Gateway to crash. This is a pre-authentication denial of service affecting clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds. **Recommendations** Update to version 3.24.2 or later.