Gandalf4A

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.1.1003 **Description** The issue is related to a heap-buffer overflow in Vim when switching to other buffers using the :all command while visual mode is still active. This occurs because Vim does not properly end visual mode, potentially allowing access beyond the end of a line in a buffer. The impact is considered medium, as the user must have switched on visual mode when executing the :all ex command. **Recommendations** For versions prior to 9.1.1003, update to Vim patch v9.1.1003 or later to fix the bug. As a temporary workaround, consider avoiding the use of the :all command while visual mode is active until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.0764 Description: The issue is related to a use-after-free problem in the BufWinLeave function of the Vim text editor. This occurs when a buffer is closed and the BufWinLeave auto command is triggered, potentially causing the same buffer to be reopened in a new split window. The impact is considered low, as it requires a specific setup and intentional actions by the user. However, it may lead to a crash. There are no known instances of this issue being exploited in real-world attacks. Recommendations: For versions prior to 9.1.0764, upgrade to version 9.1.0764 or later to resolve the issue. As a temporary workaround, consider disabling the `BufWinLeave` auto command until a patch is available. Avoid using the `BufWinLeave` auto command in scenarios where it may cause a buffer to be reopened in a new split window.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16.7.9 iPadOS versions prior to 16.7.9 macOS Ventura versions prior to 13.6.8 iOS versions prior to 17.6 iPadOS versions prior to 17.6 watchOS versions prior to 10.6 tvOS versions prior to 17.6 visionOS versions prior to 1.3 macOS Sonoma versions prior to 14.6 **Description** The issue is related to an integer overflow that has been addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination. **Recommendations** For iOS versions prior to 16.7.9, update to iOS 16.7.9 or later. For iPadOS versions prior to 16.7.9, update to iPadOS 16.7.9 or later. For macOS Ventura versions prior to 13.6.8, update to macOS Ventura 13.6.8 or later. For iOS versions prior to 17.6, update to iOS 17.6 or later. For iPadOS versions prior to 17.6, update to iPadOS 17.6 or later. For watchOS versions prior to 10.6, update to watchOS 10.6 or later. For tvOS versions prior to 17.6, update to tvOS 17.6 or later. For visionOS versions prior to 1.3, update to visionOS 1.3 or later. For macOS Sonoma versions prior to 14.6, update to macOS Sonoma 14.6 or later.

**Name of the Vulnerable Software and Affected Versions** Jerryscript version 2.4.0 **Description** The issue is related to a SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in the `ecma get object type` function. **Recommendations** For Jerryscript version 2.4.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** radare2 version 5.8.9 **Description** The issue is an out-of-bounds read in the `r bin object set items` function located in `libr/bin/bobj.c`, which causes a crash in the `r read le32` function in `libr/include/r endian.h`. **Recommendations** For radare2 version 5.8.9, consider restricting access to the `r bin object set items` function until a patch is available. As a temporary workaround, avoid using the `r read le32` function in `libr/include/r endian.h` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.0.2121 **Description** The issue is related to a heap-use-after-free vulnerability. When executing a `:s` command for the first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later be accessed by the initial `:s` command. The user must intentionally execute the payload, and the process is tricky to do since it seems to work only reliably for the very first `:s` command. It may also cause a crash of Vim. **Recommendations** For versions prior to 9.0.2121, update to version 9.0.2121 or later to resolve the issue. As a temporary workaround, consider avoiding the use of sub-replace-special atoms inside the substitution part of the `:s` command until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev566-g50c2ab06f-master **Description** The issue is related to the `gf filterpacket del()` function in the `/gpac/src/filter core/filter.c` file of the GPAC multimedia platform. It involves incorrect use of dynamic memory, which can be exploited to impact the confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely, potentially leading to a denial of service. **Recommendations** For GPAC version 2.3-DEV-rev566-g50c2ab06f-master, as a temporary workaround, consider disabling the `gf filterpacket del()` function until a patch is available. Restrict access to the `/gpac/src/filter core/filter.c` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev566-g50c2ab06f-master **Description** The issue is related to a heap-use-after-free via the `flush ref samples` function at `/gpac/src/isomedia/movie fragments.c`. This is associated with incorrect dynamic memory usage during program execution. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. It can also lead to a denial of service when exploited remotely. **Recommendations** For GPAC version 2.3-DEV-rev566-g50c2ab06f-master, as a temporary workaround, consider disabling the `flush ref samples` function until a patch is available. Restrict access to the `/gpac/src/isomedia/movie fragments.c` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev566-g50c2ab06f-master **Description** The issue is related to a stack overflow in the `hevc parse vps extension` function, located in the `media tools/av parsers.c` file. This is caused by incorrect use of dynamic memory during program execution. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. It can also be exploited remotely to cause a denial of service. **Recommendations** As a temporary workaround, consider disabling the `hevc parse vps extension` function until a patch is available. Restrict access to the `media tools/av parsers.c` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** radare2 versions 5.8.9 and earlier **Description** An out-of-bounds read exists in the `print insn32 fpu` function of `libr/arch/p/nds32/nds32-dis.h`. This issue affects versions of radare2 prior to version 5.8.9. **Recommendations** For radare2 versions 5.8.9 and earlier, as a temporary workaround, consider disabling the `print insn32 fpu` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** radare2 versions 5.8.9 and earlier **Description** An out-of-bounds read exists in the `print insn32` function of `libr/arch/p/nds32/nds32-dis.h`. This issue affects radare2 versions prior to 5.8.9. **Recommendations** For versions 5.8.9 and earlier, consider disabling the `print insn32` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.