Stig Palmquist

A heap buffer overflow occurs when fetching float samples from a paletted image within the `i gsampf fp` function. When the `getsamples()` function is used with the type `float` for a paletted image, it allocates a buffer for only one sample per pixel. If more than one channel is requested, the process writes data beyond the buffer boundary. An attacker can control the overflowing bytes by providing a specially crafted image palette.

An issue exists where the software reads data outside the EXIF block due to unchecked start offsets in the `tiff load ifd()` function. The function validates data by ensuring the sum of `entry->offset` and `entry->size` remains within the EXIF block but fails to verify the start offset itself. In versions up to 1.032, `entry->offset` is treated as a plain integer, allowing negative values in two's-complement implementations to bypass checks. In versions 1.033 and later, the field is a `size t`, which can lead to integer wrapping on 32-bit systems. Additionally, the IFD start offset can wrap on systems where `unsigned long` is 32 bits, including 64-bit Windows. An attacker providing a specially crafted image to the `Imager->read()` function can cause the process to crash or retrieve EXIF tags containing bytes from outside the intended block.

A heap memory leak occurs when reading a JPEG file containing repeated APP13 markers. The function `i readjpeg wiol()` iterates through the marker list provided by libjpeg and allocates a new buffer using `mymalloc()` for each APP13 marker, overwriting the previous pointer without freeing the memory. Consequently, only the final payload is freed, causing the first N-1 payloads to leak on every read. In long-lived processes, such as thumbnailing or upload services, these leaks can accumulate and exhaust available memory, leading to a denial of service.

CryptX for Perl performs AEAD authentication tag comparisons in non-constant time within the streaming `decrypt done` path. The `decrypt done($tag)` function utilizes `memNE` (based on `memcmp() != 0`), which terminates the comparison at the first differing byte. This behavior creates a tag-verification oracle, where the execution time depends on the number of matching leading bytes. This issue affects GCM, CCM, ChaCha20Poly1305, EAX, and OCB modes. An attacker capable of submitting numerous candidate tags for the same nonce, ciphertext, and associated data while precisely measuring timing may recover the expected tag byte by byte to forge a verifying message. One-shot `* decrypt verify` helpers are not affected as they use constant-time comparisons within libtomcrypt.

The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field (tag 0x7875) where the UID Size or GID Size is set to 8. This occurs because the `decode ux()` function triggers `decodeLitteEndian()`, which attempts to call a misnamed helper function `unpackValueQ`. Since the actual function is defined as `unpackValue Q`, the script fails with an undefined subroutine error and exits. Library callers of IO::Compress and IO::Uncompress are not affected.

OS command injection is possible through the `send file()` function. This occurs because `send file()` utilizes Perl's 2-arg open() function, which interprets magic prefixes. Specifically, prefixes like '| cmd' and 'cmd |' open a pipe to a subprocess, while '> path' and '>> path' open a path for writing or appending. If untrusted input is passed to `send file()`, OS commands can be executed with the daemon process UID. Additionally, the read-pipe form ('cmd |') can leak subprocess stdout into the HTTP response body, and write-mode forms can create or truncate files at paths chosen by an attacker.

An issue in the `fastForward()` function allows CPU exhaustion. The function compares the length of the `$offset` variable (the digit count of the offset, ranging from 1 to 19) against the chunk size `$c` instead of comparing the `$offset` value itself. This causes the chunk size `$c` to shrink from 16 KiB to between 1 and 19 bytes per iteration. An attacker can trigger a per-byte read loop that scales with the compressed size of an entry, up to the 4 GiB non-Zip64 limit, by extracting a named entry from a malicious zip file using `IO::Uncompress::Unzip->new($zip, Name => $target)`.

Archive::Tar for Perl allows memory exhaustion when processing a tar header with an attacker-controlled entry size field. The ` read tar()` function reads each entry's payload using `$handle->read($$data, $block)`, where the `$block` variable is derived from the 12-byte size field in the tar header without an upper bound. A crafted header specifying a multi-gigabyte size forces Perl to allocate a scalar of that size, leading to memory exhaustion.

Archive::Tar for Perl allows the extraction of hardlinks to attacker-controlled paths outside the intended extraction directory. The function ` make special file()` passes the tar header's linkname to `link()` without validating it against absolute paths or `..` segments, which creates a hardlink sharing the victim file's inode. A subsequent write through the extracted name modifies the victim file. Additionally, the post-extraction chmod, chown, and utime block in ` extract file()` applies the tar header's mode, owner, and timestamps to the shared inode during extraction, as it is only guarded against symlinks via `-l`.

Archive::Tar for Perl allows the extraction of symlinks with attacker-controlled targets located outside the extraction directory. The function ` make special file()` passes the tar header's linkname to `symlink()` without validating it against absolute paths or `..` segments. While a secure-extract mode exists to guard regular file extraction, it does not cover the symlink target. Consequently, a subsequent open operation through the extracted name can read or write to an attacker-chosen path.

The session handler generates session identifiers insecurely using an MD5 hash seeded with the built-in `rand()` function. The `rand()` function is seeded by 32-bits, making it predictable and unsuitable for cryptographic purposes. Although the function is passed a maximum value based on the process ID, epoch time, and the reference address of the object, these factors do not improve the quality of the message digest seed. This predictability could allow an attacker to gain unauthorized access to systems.

The App::cpanminus package for Perl downloads code via insecure HTTP, enabling code execution for network attackers. This issue allows attackers to intercept traffic.

The issue allows for machine-in-the-middle attacks due to the lack of TLS certificate verification when connecting to a GitLab server.

The issue is related to errors in the TLS certificate authentication procedure, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem stems from the failure to verify TLS certificates when downloading distributions over HTTPS. This can lead to a man-in-the-middle attack, where an attacker could gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.

The issue allows Signature Verification Bypass.

The issue concerns the CPAN::Checksums package for Perl, which does not uniquely define signed data. This could potentially lead to security issues, although specific details about exploitation or affected devices are not provided.

The issue is related to the incorrect verification of cryptographic signatures in the CPAN language, specifically in the `Module::Signature:: verify()` function. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Name of the Vulnerable Software and Affected Versions: Digi TransPort LR54 version 4.4.0.26 and possible earlier versions Description: The issue is related to Improper Input Validation, allowing users with 'super' CLI access privileges to bypass a restricted shell and execute arbitrary commands as root. Recommendations: For version 4.4.0.26 and possible earlier versions, restrict `super` CLI access privileges to prevent bypassing of the restricted shell until a fix is available. Consider limiting the execution of arbitrary commands as root to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper input validation, allowing context-dependent attackers to trick gnupg into decrypting other ciphertext than intended. This can be achieved if the passphrase to gnupg is controlled by the adversary and the ciphertext is trusted. The vulnerability exists due to insufficient input validation in the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods of the python-gnupg package, which may allow an attacker to execute arbitrary code.

The issue allows remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix of a temporary file is well-formed. This is because the `HTTP::Body::Multipart` function uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file.