Stephan Zeisberg

A flaw exists in the handling of HTTP/2 Server Push streams. When the parent handle is configured to share connections with other handles, a use-after-free condition can occur during the cleanup process. Use-after-free is a memory corruption issue where an application continues to use a pointer after it has been freed.

A buffer overflow issue was addressed with improved bounds checking, which could allow an attacker in a privileged position to perform a denial of service attack.

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan, where an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash. This issue allows a remote attacker to cause a denial of service.

A memory corruption issue was addressed with improved validation, which may allow an application to gain elevated privileges. The issue is related to a buffer overflow in memory, potentially allowing an attacker to access confidential data, compromise its integrity, and cause a denial of service.

The issue is related to an out-of-bounds write that can cause an unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. This is ultimately caused by an off-by-one error in the ` sasl add string` function in `common.c` in cyrus-sasl. The vulnerability is associated with incorrect handling of an LDAP packet, which can be exploited by a remote attacker to cause a denial-of-service.

A buffer overflow issue was addressed with improved memory handling. An attacker in a privileged network position may be able to execute arbitrary code. The issue is related to the `asn1 get type` function in the libcups library of the CUPS print server, which can cause a stack-based buffer overflow. Exploitation of this issue may allow a remote attacker to cause a denial of service.

The issue is caused by a buffer overflow in the `asn1 get packed` function of the libcups library in the CUPS print server. This can be exploited by a remote attacker to cause a denial of service. An attacker in a privileged network position may be able to execute arbitrary code due to a buffer overflow issue, which has been addressed with improved memory handling.

Name of the Vulnerable Software and Affected Versions: fmtlib versions prior to 4.1.0 Description: The issue is related to a memory corruption problem that can cause a Denial of Service. It occurs when an invalid format specifier is used in the `fmt::print()` function, resulting in a SIGSEGV due to memory corruption. This can be exploited by specifying an invalid format specifier in the `fmt::print()` function. Recommendations: For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider validating format specifiers before passing them to the `fmt::print()` function to minimize the risk of exploitation.

The issue concerns a "file path injection vulnerability" in the ZipCommon::isValidPath() function, which does not properly restrict the filename value in the ZIP header. This allows attackers to conduct absolute path traversal attacks during ZIP decompression, potentially creating or overwriting arbitrary files via a crafted ZIP file.

The issue is related to the incorrect handling of overly long commands in the main.c component of the ProFTPD FTP server. This can lead to a remote unauthenticated denial-of-service, causing the server to enter an infinite loop. The vulnerability allows a remote attacker to exploit this weakness, resulting in a denial-of-service.