CWE-131

W serwerze licencji aplikacji IBM Merge Healthcare eFilm Workstation istnieje podatność typu buffer overflow, która umożliwia zdalnemu, nieuwierzytelnionemu atakującemu wykonanie dowolnego kodu na podatnym systemie. Podatność otrzymała maksymalny wynik CVSS 10.0, co czyni ją ekstremalnie krytyczną.

W serwerze licencji oprogramowania IBM Merge Healthcare eFilm Workstation istnieje podatność typu stack-based buffer overflow, która umożliwia zdalnemu, nieuwierzytelnionemu atakującemu przejęcie pełnej kontroli nad systemem. Krytyczny poziom zagrożenia wynika z braku wymagań dotyczących uwierzytelnienia oraz możliwości uzyskania uprawnień SYSTEM.

Podatność w bibliotece libceph jądra Linux umożliwia dostęp poza zakresem pamięci (out-of-bounds access) podczas przetwarzania wiadomości CEPH_MSG_OSD_MAP zawierającej mapę CRUSH. Ze względu na krytyczny wynik CVSS 9.8 oraz brak konieczności uwierzytelnienia, stanowi poważne zagrożenie dla systemów korzystających z Ceph.

Podatność w module mod_verto systemu FreeSWITCH umożliwia przepełnienie bufora na stercie (heap buffer overflow) przez nieuwierzytelnionego atakującego. Ze względu na brak wymagań autoryzacji i sieciowy wektor ataku, luka jest sklasyfikowana jako krytyczna z wynikiem CVSS 9.8.

Podatność w jądrze Linux w funkcji ipv6_rpl_srh_rcv() umożliwia zapis poza granicami bufora (out-of-bounds write) podczas przetwarzania nagłówka IPv6 RPL Source Routing Header (RFC 6554). Luka ma krytyczny poziom zagrożenia (CVSS 9.8) i może zostać wywołana przez nieuwierzytelnionego atakującego przez sieć.

Urządzenie Delta Electronics AS320T zawiera podatność polegającą na nieprawidłowym obliczaniu rozmiaru bufora na stosie w procedurze obsługi żądań GET/PUT usługi web. Błąd sklasyfikowany jako CRITICAL (CVSS 9.8) może zostać wykorzystany zdalnie bez uwierzytelnienia.

W bibliotece LibRaw istnieje krytyczna podatność typu heap-based buffer overflow w funkcji HuffTable::initval. Atakujący może dostarczyć specjalnie spreparowany plik, aby doprowadzić do przepełnienia bufora sterty i potencjalnie przejąć kontrolę nad systemem.

Podatność typu out-of-bounds write w funkcji sopen_FAMOS_read biblioteki libbiosig umożliwia wykonanie dowolnego kodu na atakowanym systemie. Błąd jest wywoływany przez specjalnie spreparowany plik .famos, co czyni go szczególnie niebezpiecznym w środowiskach przetwarzających zewnętrzne dane biomedyczne.

In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams when the write(2) system call returns an error.  Depending on the nature of an application that calls libc's stdio functions and the presence of errors returned from the write(2) system call (or an overridden stdio write routine) a heap buffer overflow may occur. Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program.

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually.

memory corruption in modem due to improper check while calculating size of serialized CoAP message

An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

A buffer size validation vulnerability in the overlayd service of Juniper Networks Junos OS may allow an unauthenticated remote attacker to send specially crafted packets to the device, triggering a partial Denial of Service (DoS) condition, or leading to remote code execution (RCE). Continued receipt and processing of these packets will sustain the partial DoS. The overlayd daemon handles Overlay OAM packets, such as ping and traceroute, sent to the overlay. The service runs as root by default and listens for UDP connections on port 4789. This issue results from improper buffer size validation, which can lead to a buffer overflow. Unauthenticated attackers can send specially crafted packets to trigger this vulnerability, resulting in possible remote code execution. overlayd runs by default in MX Series, ACX Series, and QFX Series platforms. The SRX Series does not support VXLAN and is therefore not vulnerable to this issue. Other platforms are also vulnerable if a Virtual Extensible LAN (VXLAN) overlay network is configured. This issue affects Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R2-S4, 19.4R3-S1; 20.1 versions prior to 20.1R2-S1, 20.1R3; 20.2 versions prior to 20.2R2, 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1.

An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.

RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the required buffer capacity and validate against the provided buffer size. The base64_estimate_decode_size() function calculates the expected decoded size with an arithmetic round-off error and does not take into account possible padding bytes. Due to this underestimation, it may be possible to craft base64 input that causes a buffer overflow.

While processing MT Secondary PDP request, Buffer overflow will happen due to incorrect calculation of buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2

The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.

Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.

Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an away message with a large number of AIM substitution strings, such as %t or %n.