Tristan Madani

A race condition exists in the Windows SMB Server Network Transport Driver (srvnet.sys), where concurrent execution using a shared resource occurs with improper synchronization. This allows an authorized attacker to execute arbitrary code over a network and affect the system.

The `decompress mysql payload()` function in `lib/mysql data stream.cpp` fails to verify that the actual output length matches the `payload length` variable when `uncompress()` returns Z OK. An authenticated MySQL client using compression can provide an inflated `payload length`, leading the `buffer2array()` function to process uninitialized heap buffer data as MySQL packet headers. This can result in stale data being forwarded to the backend, potentially disclosing previous SQL queries, credentials, session state, or result data through backend error responses. Additionally, malformed lengths may lead to excessive memory allocations.

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http body max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content length to grow buffers unbounded and exhaust worker memory.

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read surface class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app id over IPC.

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms join and ms sjoin to crash the ircd or potentially achieve remote code execution.

An integer overflow exists in the `jbigtopnm` utility when calculating the output buffer size. A remote attacker can exploit this by providing a specially crafted multi-plane JBIG file with excessively large header dimensions. This leads to a heap buffer overflow within the `jbg dec merge planes()` function, which may result in application crashes or arbitrary code execution.

An out-of-bounds read exists in the `get pixel()` function of the tgatoppm converter. The issue occurs because the converter uses unchecked pixel values as color map indexes. A remote attacker can provide a specially crafted color-mapped Targa file with pixel values that exceed the declared color map bounds, leading to a program crash or the leakage of adjacent memory into the resulting output image.

A heap buffer overflow exists in the `xpmtoppm()` function due to an unvalidated characters-per-pixel value in the XPM header. An attacker can provide a specially crafted XPM file where the characters-per-pixel value exceeds 3, leading to an overrun of fixed 3-byte `colorName` hash entries. This can result in application crashes or potential arbitrary code execution.

A heap-based buffer overflow exists in the `readChannels()` function of sgitopnm when processing RLE-compressed SGI images. RLE (Run-Length Encoding) is a simple form of lossless data compression. An attacker can use crafted SGI files with oversized offset table lengths to write controlled data beyond the heap buffer, which may lead to application crashes or arbitrary code execution.

Multiple issues exist in the software that can lead to crashes or remote code execution when processing crafted files. In the `winicontopam` tool, an integer overflow occurs when handling ICO or CUR files with width or height dimensions exceeding 32767. This causes `int16 t` loop counters to wrap into negative row buffer indices, resulting in heap memory corruption. Additionally, the `picttoppm` tool contains a stack overflow in the `paintPoly()` function when processing PICT polygons with more than 100 points. Finally, the `jbigtopnm` tool is subject to an integer overflow when processing large multi-plane JBIG files, which leads to a heap buffer overflow.

A stack-based buffer overflow exists in the `scanPoly()` function within the `converter/ppm/picttoppm.c` file of the picttoppm utility. This occurs when the converter processes a specially crafted PICT file containing polygon edges that generate more than 5000 points, causing the `coord` stack array to overflow. This can lead to a program crash or potential arbitrary code execution.

A memory leak exists in the `js atomics store()` function within `quickjs.c` that occurs when a RangeError is returned because the converted value is not freed. An attacker executing JavaScript can trigger this by repeatedly calling `Atomics.store` using a `valueOf` that detaches or shrinks the buffer, leading to heap memory exhaustion and a denial of service.

An integer overflow exists in the `js proxy get own property names()` function within the quickjs.c file, which leads to a heap buffer overflow on 32-bit hosts. This occurs when JavaScript code returns a large array-like object from a Proxy ownKeys trap, causing the allocation size to wrap. This condition can result in system crashes or potential arbitrary code execution.

A stack-based buffer overflow exists in the `paintPoly()` function of the picttoppm utility. This occurs because the software does not limit the number of points in a polygon. An attacker can use a specially crafted PICT file containing a polygon with more than 100 points to overwrite the fixed `pts` array, which may lead to application crashes or arbitrary code execution.

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd sticker find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

An integer overflow exists in the `js typed array sort()` function within quickjs.c. On 32-bit hosts, an attacker capable of executing JavaScript can trigger a heap buffer overflow by calling `TypedArray.prototype.sort` with a comparator on a typed array containing approximately 2^30 elements. This causes the allocation size to wrap, leading to indices being written beyond the buffer, which may result in a system crash or potential code execution.

A heap out-of-bounds write issue exists in the `scimgdataloader psd` loader. The problem occurs because the loader uses unchecked PSD file values as lookup array indexes. An attacker can exploit this by tricking a user into importing or placing a specially crafted PSD file, which leads to heap memory corruption. This may result in application crashes or potential arbitrary code execution with the privileges of the user.