Tygls

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O chunk deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O mtime new decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.

A buffer overflow can be triggered remotely via the manipulation of the `transmatrix count`/`pcBoneTransforms` argument within the `Assimp::MDLImporter::ParseBoneTrafoKeys 3DGS MDL7()` function, located in the 3DGS MDL7 Bone Transformation Key Parser component.

A heap-based buffer overflow exists in the File Parser component. The issue occurs within the `decompressBlock()` function located in the `code/Common/Compression.cpp` file. A remote attacker can trigger this flaw through specific manipulation, potentially leading to memory corruption.

A heap-based buffer overflow can occur in the 3DGS MDL7 Model Parser component. The issue resides in the `Assimp::MDLImporter::ReadFaces 3DGS MDL7()` function within the `code/AssetLib/LWO/LWOLoader.h` library. A remote attacker can trigger this flaw through specific manipulation, potentially leading to memory corruption.

A buffer overflow occurs in the 3DGS MDL7 Model Output Mesh Generator component within the file code/AssetLib/MDL/MDLLoader.cpp. The issue resides in the `Assimp::MDLImporter::GenerateOutputMeshes 3DGS MDL7()` function, which can be exploited remotely.

A heap-based buffer overflow occurs in the Node Parser component within the file code/AssetLib/MDL/MDLLoader.cpp. The issue is triggered by the manipulation of the `bones num` argument in the `Assimp::MDLImporter::AddBonesToNodeGraph 3DGS MDL7()` function, which allows for remote execution of the attack.

A double free issue exists in the PLY Model Handler component within the `Assimp::Exporter::ExportToBlob()` function located in the `code/AssetLib/Ply/PlyLoader.cpp` file. This flaw allows a remote attacker to trigger a double free, which occurs when the program attempts to free the same memory location twice, potentially leading to a crash or arbitrary code execution.

A heap-based buffer overflow occurs in the CSM File Handler component. The issue resides in the `Assimp::CSMImporter::InternReadFile()` function within the `code/AssetLib/CSM/CSMLoader.cpp` file. This flaw allows for local execution to trigger the overflow.

An issue exists in the Model File Handler component within the `Assimp::SceneCombiner::Copy()` function located in the `code/Common/SceneCombiner.cpp` file. A heap-based buffer overflow occurs when the `width` and `height` arguments are manipulated. This flaw requires local access to be exploited.

A heap-based buffer overflow occurs in the Bitcode File Handler component within the library llvm/lib/IR/IntrinsicInst.cpp. The issue is located in the `GCRelocateInst::getBasePtr()` function and can be exploited by a local attacker.

A heap-based buffer overflow exists in the LightPcapNg Parser component within the `parse by block type()` function of the `light pcapng.c` file. This issue occurs when the `captured packet length` argument is manipulated, allowing a remote attacker to trigger the overflow. The attack is characterized by high complexity and difficult exploitability.

A heap-based buffer overflow exists in the Telnet Subnegotiation Packet Handler component. The issue occurs within the `getSubCommand()` function located in the `Packet++/src/TelnetLayer.cpp` file. This flaw allows a remote attacker to trigger the overflow through manipulation, although the attack complexity is high and exploitability is considered difficult.

A heap-based buffer overflow exists in the TLS Hello Handler component. The issue occurs within the `pcpp::SSLClientHelloMessage::getHandshakeVersion()` function located in the `Packet++/src/SSLHandshake.cpp` file. A remote attacker can trigger this by manipulating the `handshakeVersion` argument. This attack is characterized by high complexity and is considered difficult to exploit.

A heap-based buffer overflow exists in the Modbus Protocol Handler component within the `Packet++/header/ModbusLayer.h` library. The issue occurs when the `pcpp::ModbusLayer::getLength()` function processes a manipulated `length` argument. This flaw allows for remote attacks, although they are characterized by high complexity and difficult exploitability.

A stack-based buffer overflow occurs in the ValueSymbolTable Module within the library `/lib/IR/ValueSymbolTable.cpp`. The issue is triggered by the `llvm::StringMap::insert()` function. Successful exploitation requires local access to the system.

A heap-based buffer overflow occurs in the Half-Life 1 MDL Loader component. The issue is located within the `read meshes()` function of the HL1MDLLoader.cpp file. This flaw allows for local execution of an attack.

A heap-based buffer overflow occurs in the Half-Life 1 MDL Loader component within the `read animations()` function of the HL1MDLLoader.cpp file. This issue requires local access to be exploited.

A heap-based buffer overflow occurs in the Half-Life 1 MDL Loader component within the `HL1MDLLoader::extract anim value()` function of the HL1MDLLoader.cpp file. This issue is triggered by manipulating the `num.total` argument and requires the attack to be initiated from a local position.

A use after free issue exists in the ASE File Parser component within the `aiNode::~aiNode()` function of the scene.cpp file. This flaw allows a local attacker to execute a manipulation that leads to the use of memory after it has been freed.

An out-of-bounds read occurs in the Half-Life 1 MDL Loader component within the `HL1MDLLoader::read sequence infos()` function of the HL1MDLLoader.cpp file. This issue is triggered by the manipulation of the `aiString` argument and requires local access to be exploited.