Jia-Ju Bai

**Name of the Vulnerable Software and Affected Versions** FUJIFILM Business Innovation MFPs (affected versions not specified) **Description** An out-of-bounds write issue exists in FUJIFILM Business Innovation MFPs. Sending a specially crafted Internet Printing Protocol (IPP) or Line Printer Daemon (LPD) packet can lead to a denial-of-service (DoS) condition. A system reset is required to recover from the DoS condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DocuPrint CP225w versions 01.22.01 and earlier DocuPrint CP228w versions 01.22.01 and earlier DocuPrint CM225fw versions 01.10.01 and earlier DocuPrint CM228fw versions 01.10.01 and earlier **Description** An out-of-bounds write issue exists in the affected devices. If a specially crafted printer job file is processed by an affected multifunction printer (MFP), a denial-of-service (DoS) condition may occur. **Recommendations** For DocuPrint CP225w versions 01.22.01 and earlier, update to a version later than 01.22.01. For DocuPrint CP228w versions 01.22.01 and earlier, update to a version later than 01.22.01. For DocuPrint CM225fw versions 01.10.01 and earlier, update to a version later than 01.10.01. For DocuPrint CM228fw versions 01.10.01 and earlier, update to a version later than 01.10.01. As a temporary workaround, consider restricting the processing of specially crafted printer job files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.5 **Description** The vulnerability is related to a possible NULL pointer dereference caused by driver concurrency in the Linux kernel's dwc2 component. When the functions ` dwc2 hcd urb enqueue()` and ` dwc2 hcd urb dequeue()` are executed concurrently, the NULL check of `urb->hcpriv` can be executed before `urb->hcpriv = NULL`. After `urb->hcpriv` is NULL, it can be used in the function call to `dwc2 hcd urb dequeue()`, which can cause a NULL pointer dereference. This issue was found using an experimental static analysis tool that analyzes locking APIs to extract function pairs that can be concurrently executed and identifies possible concurrency bugs. **Recommendations** To fix this possible bug, `urb->hcpriv = NULL` should be executed with holding the lock `hsotg->lock`. As a temporary workaround, consider disabling the ` dwc2 hcd urb enqueue()` and ` dwc2 hcd urb dequeue()` functions until a patch is available. Restrict access to the `dwc2 hcd urb dequeue()` function to minimize the risk of exploitation. Avoid using the `urb->hcpriv` variable in the affected API endpoints until the issue is resolved. Apply the patch that executes `urb->hcpriv = NULL` with holding the lock `hsotg->lock` to fix the vulnerability.