Kevinbackhouse

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions prior to 0.28.8 **Description** Exiv2 is a C++ library and a command-line utility used for reading, writing, deleting, and modifying Exif, IPTC, XMP, and ICC image metadata. A flaw exists in the CRW image parser that can lead to an out-of-bounds read. The issue is present in the `CrwMap::decode0x0805` function. **Recommendations** Versions prior to 0.28.8 should be updated to version 0.28.8 or later.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions prior to 0.28.8 **Description** Exiv2 is a C++ library and a command-line utility used to read, write, delete, and modify image metadata (Exif, IPTC, XMP, and ICC). A flaw exists in the preview component where an integer overflow can occur when the utility is run with an extra command-line argument, such as -pp. This overflow leads to an attempt to create an excessively large `std::vector`, resulting in an uncaught exception and causing Exiv2 to crash. **Recommendations** Versions prior to 0.28.8 should be updated to version 0.28.8 or later.

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 25.06.0 Description: The issue is related to the use of `std::atomic int` for reference counting in the Poppler PDF rendering library. Since `std::atomic int` is only 32 bits, it is possible to overflow the reference count, which can trigger a use-after-free. Recommendations: For versions prior to 25.06.0, update to version 25.06.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Giskard versions prior to 2.15.5 **Description** A Remote Code Execution (ReDoS) vulnerability was discovered in the Giskard component. This issue can trigger exponential regex evaluation times when processing datasets with specific text patterns, potentially leading to denial of service. The vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection, where a regex used to detect URLs and links is vulnerable to catastrophic backtracking. **Recommendations** For Giskard versions prior to 2.15.5, upgrade to version 2.15.5 or later, which includes a fix for this vulnerability. As a temporary workaround, consider restricting the use of the text perturbation detection feature until the issue is resolved. Avoid using the vulnerable regex pattern in the text perturbation detector to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libcue versions 2.2.1 and prior **Description** The issue is related to out-of-bounds array access in libcue, which provides an API for parsing and extracting data from CUE sheets. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to ~/Downloads, it is then automatically scanned by tracker-miners, and since it has a .cue filename extension, tracker-miners use libcue to parse the file, allowing the file to exploit the vulnerability in libcue to gain code execution. **Recommendations** For versions 2.2.1 and prior, update to version 2.3.0 to resolve the issue. As a temporary workaround, consider disabling the use of libcue for parsing .cue files until a patch is available. Restrict access to the tracker-miners to minimize the risk of exploitation. Avoid downloading and opening cue sheets from untrusted sources.

**Name of the Vulnerable Software and Affected Versions** cmark-gfm versions prior to 0.29.0.gfm.12 **Description** cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. The issues include polynomial time complexity in multiple components like autolink extension, handle close bracket, and parsing of certain text patterns (leading `>`, `-`, ` `). An out-of-bounds read in the `validate protocol` function was also identified. **Recommendations** For versions prior to 0.29.0.gfm.12, upgrade to version 0.29.0.gfm.12 to patch the vulnerabilities. If upgrading is not possible, validate input from trusted sources to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the autolink extension, handle close bracket, and parsing of certain text patterns until a patch is available. Avoid using the `validate protocol` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** cmark-gfm versions prior to 0.29.0.gfm.7 **Description** The issue is related to a crafted markdown document that can trigger an out-of-bounds read in the `validate protocol` function. This bug is believed to be harmless in practice because the out-of-bounds read accesses `malloc` metadata without causing any visible damage. Additionally, there are issues with polynomial time complexity in multiple components, which may lead to unbounded resource exhaustion and denial of service. **Recommendations** For versions prior to 0.29.0.gfm.7, upgrade to version 0.29.0.gfm.7 or later to patch the vulnerability. As a temporary workaround, consider validating input from trusted sources to minimize the risk of exploitation. Restrict access to untrusted markdown documents until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** cmark-gfm versions prior to 0.29.0.gfm.7 **Description** cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. The issue is related to several polynomial time complexity problems that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. **Recommendations** For versions prior to 0.29.0.gfm.7, upgrade to version 0.29.0.gfm.7 or later to patch the vulnerabilities. If upgrading is not possible, validate input from trusted sources to minimize the risk of exploitation. As a temporary workaround, consider restricting the input size to prevent large values from being piped to cmark-gfm.

**Name of the Vulnerable Software and Affected Versions** cmark-gfm versions prior to 0.29.0.gfm.7 cmark-gfm versions prior to 0.29.0.gfm.12 **Description** The issue concerns a polynomial time complexity problem in cmark-gfm, which may lead to unbounded resource exhaustion and subsequent denial of service. This problem affects multiple components, including autolink extension, handle close bracket, and parsing of certain text patterns, such as those starting with `>`, `-`, or ` `. An out-of-bounds read was also identified in the `validate protocol` function, although it is considered less severe. **Recommendations** For versions prior to 0.29.0.gfm.7, update to version 0.29.0.gfm.7 or later to resolve the issue. For versions prior to 0.29.0.gfm.12, update to version 0.29.0.gfm.12 to ensure all patches are applied. As a temporary workaround, consider validating input from trusted sources if upgrading is not immediately possible.

**Name of the Vulnerable Software and Affected Versions** Nextcloud News for Android versions prior to 0.9.9.63 **Description** The Nextcloud News for Android app has a security issue where a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. **Recommendations** For versions prior to 0.9.9.63, upgrade to version 0.9.9.63 or higher as soon as possible. As a temporary workaround, consider restricting access to the non-exported Content Providers to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.4 and earlier **Description** The issue is related to a lack of division by zero check in the Exiv2 library, which can cause a denial of service when a specially crafted image file is used. An attacker could exploit this to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is triggered when printing the interpreted data, which requires an extra command line option (`-p t` or `-P t`). **Recommendations** For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the `-p t` or `-P t` command line options to minimize the risk of exploitation. Restrict access to crafted image files to prevent potential denial of service attacks.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.4 and earlier **Description** A null pointer dereference was found in Exiv2, which can be triggered when printing the metadata of a crafted image file. This can potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when printing the interpreted (translated) data, which requires an extra command line option (`-p t` or `-P t`). **Recommendations** For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the `-p t` or `-P t` command line options to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.4 and earlier **Description** A null pointer dereference was found in Exiv2, which can be triggered when printing the metadata of a crafted image file. This can potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when printing the interpreted (translated) data, which requires an extra command line option (`-p t` or `-P t`). **Recommendations** For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the `-p t` or `-P t` command line options to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.4 and earlier **Description** An out-of-bounds read was found in Exiv2, a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file, specifically when printing the image ICC profile using the extra command line option `-p C`. An attacker could potentially exploit this issue to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. **Recommendations** For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the `-p C` command line option to minimize the risk of exploitation. Restrict access to crafted image files to prevent potential attacks.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.4 and earlier **Description** The issue is related to an infinite loop in Exiv2 when modifying the metadata of a crafted image file, potentially allowing an attacker to cause a denial of service. This bug is triggered when deleting the IPTC data, which requires an extra command line option (`-d I rm`). The vulnerability can be exploited by tricking the victim into running Exiv2 on a specially crafted image file. **Recommendations** For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the `-d I rm` command line option to delete IPTC data until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.3 and earlier **Description** The issue is related to an inefficient algorithm with quadratic complexity in Exiv2, which can be triggered when writing metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, a less frequently used operation than reading metadata. **Recommendations** For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of Exiv2 for writing metadata into image files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.3 and earlier **Description** An out-of-bounds read was found in Exiv2, triggered when it is used to write metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata. For example, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as `insert` is needed. **Recommendations** For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of the `insert` command-line argument when running the Exiv2 command-line application on untrusted image files. Restrict access to writing metadata to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.3 and earlier **Description** An out-of-bounds read was found in Exiv2 when used to write metadata into a crafted image file. This could potentially be exploited by an attacker to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata. **Recommendations** For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of the `insert` command-line argument when running the Exiv2 command-line application, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Exiv2 versions v0.27.3 and earlier **Description** A heap buffer overflow was found in Exiv2 when used to write metadata into a crafted image file. This could potentially allow an attacker to gain code execution if they can trick the victim into running Exiv2 on a crafted image file. The issue is triggered by writing metadata, a less frequently used operation than reading metadata. For example, adding an extra command-line argument such as `insert` can trigger the bug in the Exiv2 command-line application. The vulnerability may also allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted image file. **Recommendations** For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to fix the heap buffer overflow issue. As a temporary workaround, consider avoiding the use of the `insert` command-line argument or any other operation that triggers the writing of metadata until the update is applied. Restrict the use of Exiv2 for writing metadata to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** gdm3 versions before 3.36.2 or 3.38.2 **Description** The issue allows a local user to potentially create a new privileged account on Ubuntu and its derivatives by exploiting a vulnerability in the GNOME Display Manager (GDM) when it cannot contact the accountservice service via dbus in a timely manner. This can be chained with another issue to achieve privilege escalation. The vulnerability is resolved in GNOME 3.36.2 and 3.38.2. **Recommendations** For gdm3 versions before 3.36.2, update to version 3.36.2 or later. For gdm3 versions before 3.38.2, update to version 3.38.2 or later. As a temporary workaround, consider restricting access to the accountservice service via dbus to minimize the risk of exploitation.