Vull

**Name of the Vulnerable Software and Affected Versions** valkey-io valkey versions prior to 9.0.6 valkey-io valkey versions prior to 9.1.2 **Description** A weakness exists in the `kvstoreGetHashtable()` function within the `src/kvstore.c` file. Manipulation of the `didx` variable can lead to an out-of-bounds read, which occurs when the software reads data outside the intended boundary of a buffer. This issue can be triggered remotely but requires high complexity, specifically requiring cluster mode and an attacker-controlled `dump.rdb` file at startup, which could be achieved via data-dir write access, a replication feed, or a stored crafted RDB. This can result in a Denial of Service (DoS) at boot. **Recommendations** Deploy patch 4691888e7fab3df128f0bde5750c9fde2ae552fa for versions prior to 9.0.6. Deploy patch 4691888e7fab3df128f0bde5750c9fde2ae552fa for versions prior to 9.1.2.

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster migrateslots.c of the component Slot Migration. The manipulation of the argument job name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

**Name of the Vulnerable Software and Affected Versions** Systerel S2OPC versions prior to 1.7.4 **Description** A remote attacker can cause a use after free condition by manipulating the `EventFilter` argument within the `monitored item event filter treatment bs init event filter ctx and result()` function located in the `src/ClientServer/services/bgenc/subscription mgr.c` file. Use after free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed. **Recommendations** Apply patch a4cee16a851b971be447a6ed531173702c722b99 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** valkey-io valkey version 9.1.0 **Description** A double free issue exists in the Module Timer Subsystem within the `moduleTimerHandler()` function located in the `src/module.c` file. This flaw allows a remote attacker to trigger a double free, which occurs when the system attempts to free the same memory location twice, potentially leading to a crash or arbitrary code execution. **Recommendations** Deploy patch b349fe2821e3998534b1454c1b64a478daf8c6b7 for version 9.1.0.

**Name of the Vulnerable Software and Affected Versions** valkey-io valkey version 9.1.0 **Description** A use after free flaw exists in the Blocked-on-keys Subsystem within the `handleClientsBlockedOnKey()` function located in the src/blocked.c file. This issue can be triggered remotely, although the attack complexity is high and exploitability is considered difficult. **Recommendations** Apply patch b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b for version 9.1.0.

**Name of the Vulnerable Software and Affected Versions** open62541 versions prior to 1.5.6 **Description** A remote attack can trigger a use after free condition within the History Backend component. This occurs specifically in the `UA DataValue backend copyRange()` function located in the `plugins/historydata/ua history data backend memory.c` file. Use after free is a memory corruption issue where a program continues to use a pointer after it has been freed, potentially leading to crashes or arbitrary code execution. **Recommendations** Update open62541 to a version newer than 1.5.5. As a temporary mitigation, restrict access to the History Backend component to minimize the risk of remote exploitation.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A use after free issue exists in the URCB Revalidation component within the `deleteDataSetValuesShadowBuffer()` function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw allows for local manipulation of the system. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** open62541 versions prior to 1.5.6 **Description** A heap-based buffer overflow occurs in the `UA Client readNodeClassAttribute()` function within the `src/client/ua client highlevel.c` file. This issue requires local access to be exploited. **Recommendations** Update to a version newer than 1.5.5. As a temporary workaround, restrict access to the `UA Client readNodeClassAttribute()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Systerel S2OPC versions prior to 1.7.4 **Description** A weakness in the DeleteMonitoredItemsRequest Handler component allows for an out-of-bounds read, which occurs when the system reads data outside the intended boundary of a buffer. This issue is located within the `LockedStaMac ProcessMsg DeleteMonitoredItemsResponse()` function in the file src/ClientServer/frontend/client wrapper/internal/state machine.c. This flaw can only be exploited by a local attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** open62541 (affected versions not specified) **Description** A use after free issue exists in the `UA Client getRemoteDataTypes()` function within the examples/custom datatype/client types custom.c file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This issue can be exploited by a local attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** davenardella snap7 versions prior to 1.4.4 **Description** A security flaw allows for a remote out-of-bounds write, which occurs when the `PDULength` argument is manipulated within the `TSnap7Peer::NegotiatePDULength()` function located in the `src/core/s7 peer.cpp` file. **Recommendations** Update davenardella snap7 to version 1.4.4 or later. As a temporary mitigation, restrict access to the `TSnap7Peer::NegotiatePDULength()` function to prevent remote manipulation of the `PDULength` argument.

**Name of the Vulnerable Software and Affected Versions** liftoff-sr CIPster versions prior to 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 **Description** A remote attack can trigger an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer. This issue is located in the `CipAppPath::deserialize symbolic()` function within the source/src/cip/cipepath.cc file. **Recommendations** Apply patch 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519. As a temporary workaround, restrict access to the `CipAppPath::deserialize symbolic()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** open62541 versions prior to 1.5.6 **Description** A remote issue exists in the Shared Client Library within the `responseReadNamespacesArray()` function located in the `src/client/ua client connect.c` file. Manipulation of the `Server NamespaceArray` argument can lead to a null pointer dereference, which occurs when a program attempts to read or write to a memory address that is null, typically resulting in a crash. **Recommendations** Update to a version newer than 1.5.5. As a temporary workaround, restrict the use of the `responseReadNamespacesArray()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** davenardella snap7 versions prior to 1.4.4 **Description** A flaw in the ReadVar Request Handler component allows for deserialization. The issue resides in the `TS7Worker::PerformFunctionRead()` function within the `src/core/s7 server.cpp` file. Exploitation of this issue requires the attacker to have access to the local network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.