Sebastian Pipping

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown toUtf8() and unknown toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.

A NULL pointer dereference occurs in the `externalEntityInitProcessor2()` function within `lib/xmlparse.c` due to the mishandling of the `XML TOK NONE` token when processing empty input. An attacker capable of controlling stream chunking can trigger an empty non-final first parse on an external entity subparser, which leads to an application crash during a subsequent parse.

A signed integer overflow exists in the `storeAtts()` function within `lib/xmlparse.c`. An attacker can trigger out-of-bounds writes by providing a multi-gigabyte document containing a start tag with more than 2^30 attributes. This action overflows the `attIndex` and `nPrefixes` variables, which can lead to application crashes or heap memory corruption.

A denial of service issue exists due to quadratic algorithmic complexity within the `storeAtts()` function in xmlparse.c. When processing N specified attributes with non-normalized values, the system triggers an O(N^2) linear scan of `elementType->defaultAtts` to determine CDATA status. A remote unauthenticated attacker can cause excessive CPU consumption by providing a single well-formed XML document of a few megabytes to an application parsing untrusted XML.

The software uses insufficient entropy, which allows hash flooding to occur through a specially crafted XML document. Hash flooding is a technique where many different inputs are designed to produce the same hash value, causing a collision that degrades the performance of hash tables.

The `doContent` function in libexpat does not correctly calculate the buffer size `bufSize` when reallocating memory for tags, due to a missing integer overflow check. This can lead to potential issues with memory management.

The software contains a flaw where a NULL pointer dereference can occur within the `setContext` function when retrying an operation after a previous out-of-memory condition.

The issue allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. This can be exploited when these ioctls are not disabled. The vulnerability affects both cases where root wants to drop privileges and when non-root wants to gain other privileges.

Name of the Vulnerable Software and Affected Versions: MySecureShell version 1.31 Description: MySecureShell has a local denial of service issue. Recommendations: For MySecureShell version 1.31, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: mysecureshell version 1.31 Description: The issue is related to a local information disclosure. Recommendations: For mysecureshell version 1.31, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows for information disclosure through eavesdropping on mails sent by other users.