00Xc

**Nome do software vulnerável e versões afetadas** Versões da libebml anteriores à 1.4.5 **Descrição** O problema está relacionado a um estouro de inteiro no arquivo MemIOCallback.cpp da biblioteca libebml. Esse estouro pode ocorrer durante operações de leitura ou gravação e pode resultar em estouros de buffer. A vulnerabilidade pode ser explorada por um invasor remoto para causar uma negação de serviço. **Recomendações** Para versões anteriores à 1.4.5, atualize para a versão 1.4.5 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso ao arquivo MemIOCallback.cpp ou limitar as operações que podem ser realizadas nele até que um patch seja aplicado.

**Name of the Vulnerable Software and Affected Versions** odoh-rs (affected versions not specified) **Description** A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable. **Recommendations** Update the odoh-rs rust crate to v1.0.2. As a temporary workaround, consider restricting access to the encrypted query parsing functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** github.com/cloudflare/cfnts versions prior to commit 783490b **Description** The issue is related to an unchecked read in the NTP server, which allows a remote attacker to trigger a panic by sending an NTSAuthenticator packet with an extension length longer than the packet contents. **Recommendations** For versions prior to commit 783490b, update to a version that includes the fix for this issue, specifically commit 783490b or later. As a temporary workaround, consider restricting access to the NTP server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** lua-resty-json versions up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a **Description** A debug function in the lua-resty-json package contained an out of bounds access bug that could have allowed an attacker to launch a Denial of Service (DoS) if the function was used to parse untrusted input data. The debug function was only used in tests and demos, making it not exploitable in a normal environment. **Recommendations** For versions up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a, consider disabling the debug function to prevent potential exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** xml-rs versions 0.8.9 through 0.8.13 **Description** The issue allows for a denial of service (panic) via an invalid <! token, such as <!DOCTYPEs/%<!A nesting, in an XML document. **Recommendations** For xml-rs versions 0.8.9 through 0.8.13, update to version 0.8.14 or later to resolve the issue.