Kamil Frankowicz

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 2.2.0 through 2.2.11 Wireshark versions 2.4.0 through 2.4.3 **Description** The issue concerns the JSON, XML, NTP, XMPP, and GDB dissectors in Wireshark, which could crash due to excessive recursion. This was resolved by limiting the recursion depth in the epan/tvbparse.c file. **Recommendations** For Wireshark versions 2.2.0 through 2.2.11, update to a version that includes the fix for the recursion depth limitation in epan/tvbparse.c. For Wireshark versions 2.4.0 through 2.4.3, update to a version that includes the fix for the recursion depth limitation in epan/tvbparse.c.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 2.2.0 through 2.2.11 Wireshark versions 2.4.0 through 2.4.3 **Description** The issue concerns a potential crash in the WCP dissector due to insufficient validation of the available buffer length. This was resolved by implementing proper validation in the dissector code. **Recommendations** For Wireshark versions 2.2.0 through 2.2.11, update to a version that includes the fix for the WCP dissector crash. For Wireshark versions 2.4.0 through 2.4.3, update to a version that includes the fix for the WCP dissector crash.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 2.2.0 through 2.2.11 Wireshark versions 2.4.0 through 2.4.3 **Description** The issue concerns a potential crash in the IxVeriWave file parser. This was due to incorrect signature timestamp bounds checks. The problem does not specify the number of potentially affected devices or any real-world incidents where this issue was exploited. **Recommendations** For Wireshark versions 2.2.0 through 2.2.11, update to a version that includes the correction made in wiretap/vwr.c to fix the signature timestamp bounds checks. For Wireshark versions 2.4.0 through 2.4.3, update to a version that includes the correction made in wiretap/vwr.c to fix the signature timestamp bounds checks.

**Name of the Vulnerable Software and Affected Versions** Artifex MuPDF versions prior to 2017-09-25 **Description** The issue arises from the `build filter chain` function in `pdf/pdf-stream.c`, which mishandles a specific case where a variable may reside in a register. This allows remote attackers to cause a denial of service, potentially leading to a use-after-free error of `Fitz fz drop imp` and an application crash, or possibly having other unspecified impacts, via a crafted PDF document. **Recommendations** For versions prior to 2017-09-25, update to a version released after 2017-09-25 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to the `ReadRLEImage` function in `coders/rle.c`, which mishandles RLE headers that specify too few colors. This can be exploited by remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via a crafted file. The vulnerability is associated with a buffer overflow error in the GraphicsMagick library. **Recommendations** For GraphicsMagick version 1.3.26, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ImageMagick version 7.0.6 **Description** The issue allows remote attackers to cause a denial of service, which is a heap-based buffer overflow and application crash, or possibly have other unspecified impacts via a crafted SVG document. **Recommendations** For ImageMagick version 7.0.6, update to a version that fixes the GetNextToken issue in MagickCore/token.c to prevent a heap-based buffer overflow and application crash. As a temporary workaround, consider avoiding the use of crafted SVG documents until a patch is available.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the Juniper protocols parser, specifically in the print-juniper.c file, affecting several functions. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request to exploit the buffer overread memory in the HNCP component. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the HNCP component until the update is applied.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the NFS parser, specifically in the `nfs printfh()` function within `print-nfs.c`. This problem affects the tcpdump utility. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFS parser until the update is applied.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the AODV parser, specifically in the `aodv extension()` function within `print-aodv.c`. This problem can lead to potential data exposure or crashes. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the AODV parser until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue concerns a buffer over-read in the NFS parser component of tcpdump, specifically in the `xid map enter()` function within `print-nfs.c`. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFS parser component until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to an off-by-one error in the DrawImage function, which can cause a denial of service due to a heap-based buffer over-read and application crash. This can be triggered by a remote attacker using a crafted file. The error is associated with a buffer overflow vulnerability in the DrawImage function. **Recommendations** For GraphicsMagick version 1.3.26, consider updating to a newer version that addresses the off-by-one error in the DrawImage function to prevent the denial of service and buffer over-read issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 ALT Linux (affected versions not specified) **Description** The issue concerns a buffer over-read in the IPv6 routing header parser, specifically in the `rt6 print()` function within `print-rt6.c`. This problem is related to the parsing of packets. **Recommendations** For tcpdump versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. For ALT Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the ISAKMP parser, specifically in the `isakmp rfc3948 print()` function. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `print-isakmp.c` component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the ISO CLNS parser of tcpdump, specifically in the `isoclns print()` function. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request to the HNCP component. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the HNCP component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the NFS parser component of tcpdump. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request. The buffer over-read occurs in the `interp reply()` function. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFS parser component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the IEEE 802.11 parser, specifically in the `parse elements()` function within `print-802 11.c`. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `parse elements()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions prior to 4.9.2 **Description** The issue is related to a buffer over-read in the RIPng parser, specifically in the `ripng print()` function within `print-ripng.c`. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request. **Recommendations** For versions prior to 4.9.2, update to version 4.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the RIPng parser to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick versions 1.3.26 through 7.0.6 **Description** The issue is caused by a buffer overflow in the coders/wpg.c component of the GraphicsMagick library, allowing a remote attacker to cause a denial of service or possibly execute arbitrary code using a specially crafted file. This is related to the `AcquireCacheNexus` function in `magick/pixel cache.c`. **Recommendations** For versions 1.3.26 through 7.0.6, consider disabling the `coders/wpg.c` component as a temporary workaround until a patch is available. Restrict access to the `AcquireCacheNexus` function in `magick/pixel cache.c` to minimize the risk of exploitation. Avoid using specially crafted files that could trigger the buffer overflow until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29 Description: The issue is related to the ` bfd elf parse attributes` function in the `elf-attrs.c` component of the Binary File Descriptor (BFD) library, which allows remote attackers to cause a denial of service via a crafted ELF file. This is due to a heap-based buffer over-read, leading to an application crash. The vulnerability can be exploited by a remote attacker using a specially crafted ELF file, resulting in a denial of service. Recommendations: For GNU Binutils version 2.29, consider avoiding the use of the ` bfd elf parse attributes` function until a patch is available. As a temporary workaround, restrict the processing of ELF files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ImageMagick version 7.0.6-10 **Description** The issue is related to a heap-based buffer overflow in the `TracePoint()` function, located in MagickCore/draw.c. **Recommendations** For ImageMagick version 7.0.6-10, consider updating to a newer version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.