Akshay Jain

**Nome do Software Vulnerável e Versões Afetadas** PHP versões 8.4.0 até 8.4.20 PHP versões 8.5.0 até 8.5.5 **Description** Existe um problema na extensão mbstring onde a passagem de um nome de codificação contendo um byte NUL incorporado para certas funções faz com que o código assuma incorretamente que as strings possuem o mesmo comprimento quando `strncasecmp()` retorna 0. Isso pode resultar em uma leitura fora dos limites (out-of-bounds read) da memória global, o que pode levar à divulgação de informações ou a uma falha no sistema. As funções afetadas incluem `mb convert encoding()`, `mb detect encoding()`, `mb convert variables()` e `mb detect order()`. Além disso, as configurações INI `mbstring.detect order` e `mbstring.http output` são afetadas. **Recommendations** Atualizar a versão do PHP 8.4.x para 8.4.21. Atualizar a versão do PHP 8.5.x para 8.5.6.

**Name of the Vulnerable Software and Affected Versions** LibJWT versions 3.0.0 through 3.2.9 **Description** LibJWT, a C JSON Web Token Library, has an issue in the RSA-PSS JWK parsing functionality. Versions prior to 3.3.0 do not adequately validate JSON string values, specifically failing to protect against NULL values. A crafted JWK file containing integers where strings are expected can exploit this. It is recommended to avoid importing keys from untrusted sources and to use the `jwk2key` tool to validate JWK files. If possible, avoid using JWK files with RSA-PSS keys. **Recommendations** Update to LibJWT version 3.3.0 or later. As a workaround, do not import keys through a JWK file from untrusted sources. Use the `jwk2key` tool to check the validity of a JWK file. Avoid using JWK files with RSA-PSS keys if possible.

**Name of the Vulnerable Software and Affected Versions** Huawei Wear App version prior to 15.0.0.307 **Description** The issue concerns the Huawei Wear App's failure to validate SSL certificates, allowing local users to have an unspecified impact. **Recommendations** For versions prior to 15.0.0.307, update to version 15.0.0.307 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Huawei Hilink App version prior to 3.19.2 **Description** The issue concerns the Huawei Hilink App's failure to validate SSL certificates, allowing local users to have an unspecified impact. **Recommendations** For versions prior to 3.19.2, update to version 3.19.2 or later to resolve the issue.