Tomer-Pl

The TIFF encoder in Pillow can perform an out-of-bounds read when processing images with retained TIFF metadata where the plane size is inconsistent with `BitsPerSample`. An attacker can provide a crafted TIFF file that is opened normally but contains a malformed ColorMap. When an application re-encodes this image and saves it back to TIFF format, the encoder allocates a fixed-size buffer (1536 bytes) but may attempt to read a significantly larger amount of data (up to 131072 bytes) from the heap. This occurs because the encoder fails to reconcile the fixed plane extent with the effective sample depth before passing pointers to the underlying libtiff library. This issue can lead to a process crash or the disclosure of heap memory in the output file. The vulnerability is triggered during the save process via the `PyImaging LibTiffEncoderNew()` function.

A heap buffer overflow and stale-heap disclosure exist in the ` tiffWriteProc` function when saving compressed TIFF data through libtiff to a target lacking a usable `fileno()`, such as `BytesIO`. The callback determines allocation size based on the prior buffer size rather than the current write position. This allows an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward, which can lead to process crashes or remote code execution. Additionally, unwritten alignment gaps in compressed TIFF output exceeding 64 KiB can disclose stale heap bytes. File paths and targets with real file descriptors are not affected.

An issue in the way the system loads theme translation files allows an authenticated Administrator to execute arbitrary code on the server by using a crafted theme.

Authenticated administrators can achieve remote code execution by abusing the theme translation file loading process. This occurs when an attacker with administrator privileges uploads a specially crafted theme containing malicious translation files, allowing the execution of arbitrary code on the server.

An authenticated low-privilege user can perform a server-side request forgery (SSRF) during repository migration. The issue occurs because the validation logic in `services/migrations/migrate.go` accepts a destination if any resolved IP address is allowed, even if other resolved IPs are blocked or loopback addresses. An attacker can use a DNS name that resolves to both a public allowed IP and a blocked internal IP to bypass these filters. Since the subsequent `git clone` operation performs its own DNS resolution, it may connect to the internal address, allowing the attacker to import contents from internal-only Git services or private network resources into a repository they control.

An authentication bypass exists when using a malformed SSH sub-verb during LFS (Large File Storage) operations. This flaw allows unauthorized read access to private repositories.

A network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend, leading to an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings. These strings are then visible to authenticated users through the CUPS web interface and IPP Get-Printer-Attributes responses.

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions 2.4.16 and prior Description OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. An integer underflow in the ` ppdCreateFromIPP()` function (cups/ppd-cache.c) allows a local user to crash the cupsd root process by providing a negative job-password-supported IPP attribute. The validation only limits the upper bound, allowing a negative value to pass, which is then cast to size t, wrapping to a large positive value, and used as the length argument to `memset()` on a 33-byte stack buffer. This results in a SIGSEGV in the cupsd root process, potentially leading to a denial of service when combined with systemd's Restart=on-failure setting. Recommendations Update to a version of OpenPrinting CUPS later than 2.4.16.

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions 2.4.16 and prior Description OpenPrinting CUPS is a printing system for Linux and Unix-like systems. A use-after-free issue exists in the CUPS scheduler (`cupsd`) when temporary printers are automatically removed. The `cupsdDeleteTemporaryPrinters()` function in `scheduler/printers.c` calls `cupsdDeletePrinter()` without first expiring subscriptions referencing the printer, resulting in a dangling pointer (`cupsd subscription t.dest`) to freed memory. Dereferencing this pointer at various code locations can cause the `cupsd` daemon to crash, leading to a denial of service. Heap grooming could potentially lead to code execution. Recommendations Update OpenPrinting CUPS to a version later than 2.4.16.

RefererMiddleware in `scrapy/spidermiddlewares/referer.py` incorrectly handles the `Referrer-Policy` response header. If the header value resembles a Python import path, the framework imports the referenced object and executes it, assuming it is a referrer policy class. A malicious website can exploit this by providing a callable, such as `sys.exit`, to terminate the crawler process.

Soft Serve is a self-hostable Git server for the command line. An authorization bypass exists in the LFS lock deletion endpoint. Any authenticated user with repository write access can delete locks owned by other users by setting the `force` flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation. The vulnerable endpoint is '/lfs/locks/{lock id}/delete'.

Soft Serve, a self-hostable Git server, contains a Server-Side Request Forgery (SSRF) issue. The application does not validate webhook URLs, which allows repository administrators to create webhooks that target internal services, private networks, and cloud metadata endpoints. This can lead to cloud metadata theft, internal network access, port scanning, data exfiltration, and internal API access. The vulnerable components include Webhook Creation (pkg/ssh/cmd/webhooks.go:125), Backend CreateWebhook (pkg/backend/webhooks.go:17), Backend UpdateWebhook (pkg/backend/webhooks.go:122), and Webhook Delivery (pkg/webhook/webhook.go:97). An example of exploitation involves creating a webhook that accesses `http://127.0.0.1:8080/internal` using the `webhook create` command.