Cornelius Aschermann

**Nome do software vulnerável e versões afetadas** QEMU (versões afetadas não especificadas) **Descrição** Foi detectado um estouro de pilha por meio de uma vulnerabilidade de recursão infinita no emulador de dispositivo eepro100 i8255x do QEMU. Esse problema ocorre durante o processamento de comandos do controlador devido a uma falha de reentrada de DMA. A falha permite que um usuário ou processo convidado consuma ciclos de CPU ou cause a falha do processo do QEMU no host, resultando em uma negação de serviço. A maior ameaça dessa vulnerabilidade é à disponibilidade do sistema. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** QEMU (versões afetadas não especificadas) **Descrição** Foi detectada uma falha de loop infinito no emulador de placa de rede e1000 do QEMU. Esse problema ocorre durante o processamento de descritores de transmissão (tx) na função `process tx desc`, caso vários campos do descritor sejam inicializados com valores inválidos. Essa falha permite que um convidado consuma ciclos de CPU no host, resultando em uma negação de serviço. A maior ameaça dessa vulnerabilidade é à disponibilidade do sistema. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Versões do QEMU anteriores à 5.1.1 **Descrição** O problema está relacionado a uma desreferência de ponteiro NULL na função `pci change irq level` em `hw/pci/pci.c`. Isso ocorre porque `pci get bus()` pode não retornar um ponteiro válido, permitindo potencialmente que um invasor cause uma negação de serviço. **Recomendações** Para versões anteriores à 5.1.1, atualize para a versão 5.1.1 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso à função `pci change irq level` em `hw/pci/pci.c` até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** QEMU versions 3.1.x through 4.0.0 **Description** The issue is related to a NULL pointer dereference in the `interface release resource` function in `hw/display/qxl.c`. This could potentially allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For QEMU versions 3.1.x through 4.0.0, consider disabling the `interface release resource` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gnuplot version 5.2.5 **Description** An issue in datafile.c allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in `df generate ascii array entry()`. This can be exploited by passing an overlong string as the right bound of the range argument to the `plot()` function. **Recommendations** For Gnuplot version 5.2.5, as a temporary workaround, consider restricting the input to the `plot()` function to prevent overlong strings from being passed as the right bound of the range argument. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gnuplot version 5.2.5 **Description** An issue in Gnuplot allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the `PS options` function. This flaw is caused by a missing size check of an argument passed to the `set font` function. The issue occurs when the Gnuplot postscript terminal is used as a backend. **Recommendations** For Gnuplot version 5.2.5, consider disabling the `PS options` function or restricting the use of the postscript terminal as a backend until a patch is available. Avoid using the `set font` function with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gnuplot version 5.2.5 **Description** A buffer overflow issue exists due to a missing size check of an argument passed to the `set font` function, specifically in the `cairotrm options` function when the Gnuplot pngcairo terminal is used as a backend. This allows an attacker to conduct a buffer overflow with an arbitrary amount of data. **Recommendations** For Gnuplot version 5.2.5, consider disabling the `cairotrm options` function or restricting the use of the pngcairo terminal as a backend until a patch is available. Avoid using the `set font` function with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mruby version 1.4.1 **Description** The issue concerns a signed integer overflow in the CHECK macro within the mrbgems/mruby-sprintf/src/sprintf.c file of mruby. This overflow could potentially lead to out-of-bounds memory access due to the mrb str resize function in string.c not checking for negative lengths. **Recommendations** For mruby version 1.4.1, consider applying a patch or fix that addresses the signed integer overflow in the CHECK macro to prevent potential out-of-bounds memory access. As a temporary workaround, restrict the use of the mrb str resize function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 4.15.0 **Description** The issue is related to the ntfs attr find function in the ntfs.ko filesystem driver, which allows attackers to trigger a stack-based out-of-bounds write. This can cause a denial of service, resulting in a kernel oops or panic, and may have other unspecified impacts. The attack is possible via a crafted ntfs filesystem. **Recommendations** For Linux kernel version 4.15.0, consider upgrading to a newer version that includes a fix for this issue. As a temporary workaround, restrict access to ntfs filesystems to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 4.15.0 **Description** The issue is related to the ntfs read locked inode function in the ntfs.ko filesystem driver, which allows attackers to trigger a use-after-free read. This could potentially cause a denial of service, resulting in a kernel oops or panic, via a crafted ntfs filesystem. **Recommendations** For Linux kernel version 4.15.0, consider updating to a newer version that contains a fix for this issue, as using a crafted ntfs filesystem could lead to a denial of service.

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 4.15.0 **Description** The issue is related to the ntfs end buffer async read function in the ntfs.ko filesystem driver, which allows attackers to trigger a stack-based out-of-bounds write. This can cause a denial of service, resulting in a kernel oops or panic, and may have other unspecified impacts. The attack can be initiated via a crafted ntfs filesystem. **Recommendations** For Linux kernel version 4.15.0, consider upgrading to a newer version that includes a fix for this issue. As a temporary workaround, restrict access to the ntfs.ko filesystem driver to minimize the risk of exploitation. Avoid using the ntfs filesystem until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.30 **Description** An issue was discovered in the arm pt function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils. This issue leads to stack exhaustion in the C++ demangling functions provided by libiberty. The functions involved include demangle arm hp template, demangle class name, demangle fund type, do type, do arg, demangle args, and demangle nested args. This can occur during the execution of nm-new. **Recommendations** For GNU Binutils version 2.30, consider updating to a newer version to mitigate the risk of stack exhaustion in the C++ demangling functions. As a temporary workaround, consider restricting the use of the nm-new execution to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mruby version 1.4.1 **Description** A heap-based buffer over-read issue was found, associated with OP ENTER, due to the failure of mrbgems/mruby-fiber/src/fiber.c to extend the stack when handling many arguments to fiber. **Recommendations** For mruby version 1.4.1, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** mruby version 1.4.1 **Description** An issue was discovered in mruby. There is a NULL pointer dereference in `mrb class real` because `class BasicObject` is not properly supported in class.c. **Recommendations** For mruby version 1.4.1, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** mruby version 1.4.1 **Description** The issue is related to the init copy function in kernel.c, which makes initialize copy calls for TT ICLASS objects. This allows attackers to cause a denial of service, resulting in an uninitialized pointer and application crash, or possibly have other unspecified impacts. **Recommendations** For mruby version 1.4.1, consider disabling the init copy function in kernel.c as a temporary workaround until a patch is available. Restrict access to TT ICLASS objects to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions 7.0.7-29 and earlier **Description** A memory leak was found in the formatIPTCfromBuffer function in coders/meta.c. **Recommendations** For versions 7.0.7-29 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions 7.0.7-29 and earlier **Description** The issue is related to a null pointer dereference in the ReadOneJNGImage function of the coders/png.c component. This can be exploited by a remote attacker to cause a denial of service, resulting in a WriteBlob assertion failure and application exit, via a crafted file. **Recommendations** For ImageMagick versions 7.0.7-29 and earlier, as a temporary workaround, consider disabling the ReadOneJNGImage function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: mruby versions prior to 1.4.1 Description: The issue is related to an integer overflow in the `mrb vm exec()` function when handling `OP GETUPVAR` in the presence of deep scope nesting, resulting in a use-after-free. This could allow an attacker who can cause Ruby code to be run to possibly execute arbitrary code. Recommendations: For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.30 **Description** The issue is related to a NULL pointer dereference error in the `work stuff copy to from` function of the `cplus-dem.c` component. This error can be exploited by a remote attacker to cause a denial of service. The vulnerability can occur during the execution of `objdump`. **Recommendations** For GNU Binutils version 2.30, consider updating to a newer version that contains a fix for this issue, as the current version is affected by the NULL pointer dereference error in the `work stuff copy to from` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.