Tristan Madani

SIPp through 3.7.7 contains a buffer overflow vulnerability in get peer tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get header() function in src/sip parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg load player unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

**Name of the Vulnerable Software and Affected Versions** ntop nDPI versions prior to 6.0 **Description** An out-of-bounds heap write exists in the `ndpi json string escape()` function. This occurs because the function lacks an enforceable maximum length for the destination buffer when escaping characters for JSON serialization. A single input byte can expand into up to six output characters (e.g., `u00xx`), and if the calling application allocates insufficient space, the function writes beyond the heap buffer boundaries. An unauthenticated attacker can trigger this by supplying crafted network metadata, such as TLS Server Name Indication (SNI) values, HTTP headers, or DNS names. This can lead to heap corruption, resulting in process crashes, disruption of monitoring telemetry, or potential conditional remote code execution. **Recommendations** Upgrade to nDPI version 6.0 or apply a vendor-confirmed patched backport for versions prior to 6.0. Rebuild and redeploy any applications that use nDPI as a statically linked library to ensure the fix is incorporated into the binary.

**Name of the Vulnerable Software and Affected Versions** Greenbone OpenVAS (affected versions not specified) **Description** A remote attacker with user privileges can trigger a stack buffer overflow by using a malicious or compromised NASL vulnerability test (VT). This flaw allows the attacker to achieve remote code execution and gain full access to the compromised system. NASL (Nessus Attack Scripting Language) is the scripting language used to write vulnerability tests for the scanner. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GNU Emacs versions prior to 31.0.91 **Description** An integer overflow exists in the PBM/PPM/PGM image loader. This occurs because the loader uses signed integer arithmetic to multiply image dimensions and channel count. When provided with a crafted image featuring large dimensions and an elevated max color index, the result can wrap to a negative number. This bypasses bounds checks, causing the pixel reader to access heap memory beyond the allocated buffer. The leaked heap memory contents are then interpreted as pixel color values and rendered on screen. **Recommendations** Update GNU Emacs to version 31.0.91 or later.

**Name of the Vulnerable Software and Affected Versions** libdm (affected versions not specified) **Description** A flaw in the libdm configuration file parser allows an attacker to cause a Denial of Service (DoS) by crafting a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This leads to uncontrolled recursion, which exhausts the stack and causes any LVM command reading the metadata to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** Velociraptor fails to sanitize cells when exporting data to CSV via the GUI, offline collector, or data exports. This allows for CSV Formula Injection, where Microsoft Excel executes cells beginning with specific characters as formulas upon import, potentially leading to arbitrary execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** A rogue client can upload a malformed sparse file—a type of file that attempts to use file system space more efficiently by not writing empty blocks—causing a panic that may crash the server process when the GUI attempts to expand the file. This issue is caused by a Divide by Zero bug within the `ShouldPadFile()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The `hunt delete()` VQL function allows for the deletion of hunts. The software misapplied permission checks, requiring only the `COLLECT CLIENT` permission (typically assigned to the investigator role) instead of the `DELETE RESULTS` permission (typically reserved for administrators). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Courier IMAP versions prior to 6.0.1 Courier Mail Server versions prior to 2.0.2 **Description** Authenticated IMAP users can cause the `imapd` process to crash by sending deeply nested parenthesized SEARCH queries. The issue occurs because the SEARCH command parser, specifically the `alloc search key()` function in `searchinfo.C`, recursively processes nested parenthesized groups through a mutual recursion chain involving `alloc search andlist()` and `alloc search notkey()` without a depth limit. Since there is no overall command line length limit, a single IMAP command containing approximately 2500 nested parentheses can overflow the default 8MB stack, resulting in a SIGSEGV (segmentation fault), which is a specific error caused by accessing memory that the program does not have permission to access. **Recommendations** Update Courier IMAP to version 6.0.1 or later. Update Courier Mail Server to version 2.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** GNU Wget versions prior to 1.25.1 **Description** A heap buffer underread exists in the `clean metalink string()` function within `src/metalink.c`. This occurs when the software processes a Metalink document containing a URL consisting only of whitespace. A malicious server can trigger this by serving a crafted Metalink file, causing the function to decrement a pointer past the start of the allocated buffer. This memory corruption can lead to abnormal program behavior or a denial of service resulting in a crash. **Recommendations** Update GNU Wget to the version containing commit 37a40fc.

**Name of the Vulnerable Software and Affected Versions** GNU Wget versions prior to 1.25.0 commit c2640fe **Description** A heap buffer overflow occurs in the `convert fname()` function within src/url.c. This issue is triggered when a server-supplied filename requires character set conversion and the output buffer is too small during iconv E2BIG reallocation. The reallocation logic miscalculates the remaining space, allowing a remote attacker to cause memory corruption via a maliciously crafted server response. iconv E2BIG is an error code indicating that the output buffer is too small to hold the converted string. **Recommendations** Update to the version containing commit c2640fe.

**Name of the Vulnerable Software and Affected Versions** GNU Wget versions prior to 1.25.0 commit dd692d9 **Description** A heap buffer overflow occurs in the `html quote string()` function within `src/convert.c`. A remote attacker can trigger memory corruption by providing a crafted HTML attribute containing a large number of characters that require entity encoding. This causes a signed integer counter to overflow during the accumulation of the output size, leading to an undersized heap allocation and a subsequent buffer overflow during the copy phase. **Recommendations** Update GNU Wget to the version containing commit dd692d9.

**Name of the Vulnerable Software and Affected Versions** GNU Wget versions prior to 1.25.0 commit 43d3ba9 **Description** An integer overflow occurs in the `parse content range()` function within src/http.c. This issue allows server-controlled values to cause signed integer arithmetic to overflow. An attacker can provide malicious values in the Content-Range header to trigger undefined behavior and download desynchronization in the client. **Recommendations** Update GNU Wget to the version containing commit 43d3ba9.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update Safari to version 26.5.2. Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.