Sprabhav7

A stack-based buffer overflow occurs in the Linux Bluetooth protocol stack when processing an Extended Inquiry Response (EIR) packet. A remote attacker within Bluetooth radio range can trigger this issue during Bluetooth discovery by sending a specially crafted packet, which affects the `name2utf8()` function. This can result in a Denial of Service (DoS) by crashing the bluetoothd service or potentially allow for arbitrary code execution.

A heap-based buffer overflow occurs in the CUPS scheduler when building filter option strings from job attributes. This issue is located in the `get options()` function and may allow a remote attacker to execute arbitrary code.

Netty, an asynchronous, event-driven network application framework, is susceptible to a Denial of Service (DoS) attack. A remote user can exploit this by sending a flood of `CONTINUATION` frames to a Netty HTTP/2 server. The server does not limit the number of `CONTINUATION` frames it accepts, and existing size-based protections are bypassed when zero-byte frames are used. This allows an attacker to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. The issue resides in the `DefaultHttp2FrameReader` component, specifically within the `verifyContinuationFrame()` function, which lacks a frame count check. The `HeadersBlockBuilder.addFragment()` function also allows bypassing the byte limit with zero-byte frames.

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions. The `UTF8DataInputJsonParser` and `ReaderBasedJsonParser` bypass the `maxNestingDepth` constraint defined in `StreamReadConstraints`. This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS). The `maxNestingDepth` constraint has a default value of 500. The issue was addressed by adding a check that throws a `StreamConstraintsException` if the limit is reached.

The non-blocking (asynchronous) JSON parser in jackson-core fails to enforce the `maxNumberLength` constraint defined in `StreamReadConstraints`. This occurs because the async parsing path in `NonBlockingUtf8JsonParserBase` and related classes does not invoke number length validation methods. Specifically, methods like ` finishNumberIntegralPart()` accumulate digits into the `TextBuffer` without checks, and ` valueComplete()` fails to call `resetInt()` or `resetFloat()`, where `validateIntegerLength()` and `validateFPLength()` are executed. An attacker can submit a JSON document containing a number token of arbitrary length, leading to excessive memory allocation in the `TextBuffer` and potential `OutOfMemoryError`. Additionally, if the application calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM may experience CPU exhaustion due to O(n^2) BigInteger parsing, resulting in a denial of service.