Joshua Rogers

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A use-after-free issue occurs when the `curl easy pause()` function is called within the event-based `CURLMOPT SOCKETFUNCTION` callback. This leads to a situation where libcurl attempts to store a flag using a dangling struct pointer immediately after the memory associated with that pointer has been freed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** The logic handling SASL (Simple Authentication and Security Layer) authentication may clean up the GSASL context twice without clearing the pointer in between. This results in a double-free condition when the `free()` function is called on the same pointer twice. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** Applications using libcurl for transfers via `SCP://` or `SFTP://` that utilize the `CURLOPT SSH KEYFUNCTION` callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the key type recorded for that host in the `known hosts` file. The callback mechanism fails to enforce the restriction, allowing the connection to proceed without warning, which could lead to a man-in-the-middle attack, where an attacker intercepts communication between two parties. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When configured to use a `.netrc` file for credentials while simultaneously specifying a URL containing a username but no password (e.g., `https://user@example.com/`), the software may incorrectly retrieve and use the password of a different user defined in the `.netrc` file for that host, provided no match for the specified user exists. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl versions 7.7 through 8.20.x **Description** libcurl incorrectly reuses previously created connections from its connection pool even when mutual TLS (mTLS) configuration options have changed. The connection-reuse check fails to validate five specific client certificate settings: private key, key password, key type, cert type, and key blob. Consequently, two separate transfers that differ only by these settings may share the same connection and identity. This issue is estimated to affect over 30 billion devices worldwide, including operating systems, containers, CI/CD pipelines, package managers, SDKs, and automotive systems. **Recommendations** Update libcurl to version 8.21.0.

**Name of the Vulnerable Software and Affected Versions** libssh2 versions prior to 1.11.1 commit 2dae302 **Description** An out-of-bounds heap read exists in the `sftp symlink()` function within `src/sftp.c`. A malicious SSH server or man-in-the-middle attacker can disclose heap memory contents or cause a crash by sending a crafted `SSH FXP NAME` response. This occurs because the software fails to validate the available packet buffer size before a `memcpy` operation, allowing an attacker to supply a `link len` value larger than the actual packet data during SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to `target len` minus one bytes. **Recommendations** Update to the version containing commit 2dae302 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** image-size versions prior to 2.0.3 **Description** A denial of service issue exists where remote attackers can permanently block the Node.js event loop. By supplying a specially crafted image buffer containing a box-type with a zero-valued size field, an infinite loop is triggered within the JXL or HEIF image parsers. This causes the offset to never advance, resulting in the application hanging permanently. **Recommendations** Update to version 2.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** A NULL pointer dereference occurs when partial-chain certificate verification is enabled alongside OCSP response checking for the entire chain, provided the verified chain lacks a self-signed trusted anchor. This happens because the code attempts to access the next certificate as the issuer, but the issuer remains NULL for the final certificate in the chain under these specific conditions. This can lead to a process crash and a subsequent Denial of Service. The issue specifically affects applications that enable both the `X509 V FLAG OCSP RESP CHECK ALL` and `X509 V FLAG PARTIAL CHAIN` flags, both of which are disabled by default. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid enabling both `X509 V FLAG OCSP RESP CHECK ALL` and `X509 V FLAG PARTIAL CHAIN` flags simultaneously during certificate verification.

**Name of the Vulnerable Software and Affected Versions** cap net service (affected versions not specified) **Description** An issue exists in the `cap net` service where omitting a key from a new limit that was present in the old limit causes the missing key to be treated as allow any instead of being rejected. This allows an application that previously had restricted network operations to request a new limit that extends the process permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** fusefs (affected versions not specified) **Description** When a fusefs file system implements extended attributes, the kernel may send a FUSE LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module uses the `strlen()` function on this buffer without verifying that the list is NUL-terminated. A malicious daemon can send a non-NUL-terminated list, causing the kernel module to read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. This can lead to the disclosure of up to 253 bytes of kernel heap memory or the injection of up to 250 attacker-controlled bytes into unallocated kernel heap space. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD libcasper(3) (affected versions not specified) **Description** libcasper(3) communicates with helper processes via UNIX domain sockets and utilizes the `select(2)` system call to wait for available data. The software fails to verify if the socket descriptor is within the `FD SETSIZE` limit of 1024. An attacker can trigger stack corruption by causing an application using libcasper(3) to allocate large file descriptors, such as by opening numerous descriptors and executing a program that does not close them upon startup. If the target application runs with setuid root privileges, this can lead to local privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A use-after-free issue exists in libcurl involving the HTTP/2 stream-dependency tree management. This occurs when an application configures the tree using `CURLOPT STREAM DEPENDS` or `CURLOPT STREAM DEPENDS E`, calls the `curl easy reset()` function, and then terminates the handle via the `curl easy cleanup()` function. During the final cleanup, the library attempts to access and modify an internal structure that was already freed during the reset operation. This flaw may allow a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.4.3 **Description** An authorization bypass exists in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record (a DNS record that maps an IP address to a hostname) for their source IP address. This allows connections from hostnames that administrators intended to deny in scenarios where reverse DNS resolution fails and defaults to UNKNOWN. **Recommendations** Update to version 3.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update iOS to version 26.5. Update iPadOS to version 26.5. Update macOS Tahoe to version 26.5. Update tvOS to version 26.5. Update visionOS to version 26.5. Update watchOS to version 26.5.

**Name of the Vulnerable Software and Affected Versions** dhclient (affected versions not specified) **Description** When building an environment to pass to dhclient-script, the software may resize the array of string pointers. The code responsible for expanding this array incorrectly calculates the new memory size, leading to a heap buffer overrun (a memory corruption where data is written beyond the boundaries of a heap-allocated buffer). A specially crafted packet can trigger this overrun, potentially causing a system crash or allowing remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD dhclient (affected versions not specified) **Description** The FreeBSD DHCP client fails to escape embedded double-quotes when writing the BOOTP `file` field to the lease file. This allows a rogue DHCP server on the same network to inject arbitrary `dhclient.conf` directives. When the lease file is re-parsed, such as after a system restart, the attacker-controlled field is passed to the `dhclient-script()` function, which evaluates it, potentially leading to arbitrary code execution with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gnutls versions prior to 3.8.13-1.1 **Description** No detailed information was provided regarding the nature of the security issues fixed in this package. **Recommendations** Update to version 3.8.13-1.1.

**Name of the Vulnerable Software and Affected Versions** libnv (affected versions not specified) **Description** When exchanging data over a socket, the software uses the `select()` function to wait for data. It fails to verify if the provided socket descriptor exceeds the file descriptor set size limit of `FD SETSIZE` (1024). An attacker capable of forcing the application to allocate large file descriptors can trigger stack corruption. If the target application is setuid-root, this may lead to local privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gnutls versions prior to 3.8.13-1.1 **Description** No detailed information was provided regarding the nature of the security issues fixed in this package. **Recommendations** Update to version 3.8.13-1.1.

**Name of the Vulnerable Software and Affected Versions** gnutls versions prior to 3.8.13-1.1 **Description** Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) incorrectly match usernames containing a NUL character with truncated usernames. A remote attacker can exploit this by sending a specially crafted username to bypass the authentication process and gain unauthorized access. **Recommendations** Update to version 3.8.13-1.1.