Lvtao-Sec

**Name of the Vulnerable Software and Affected Versions** Gluster GlusterFS version 11.0 **Description** The issue is related to a stack-based buffer over-read in the `fuse-bridge.c` file, specifically in the `notify` function. This is a general information about the problem, but details about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited are not provided. **Recommendations** For Gluster GlusterFS version 11.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GlusterFS version 11.0 **Description** The issue is related to a use-after-free error in the `dht setxattr mds cbk` function of the `xlators/cluster/dht/src/dht-common.c` component in the GlusterFS file system. This allows a remote attacker to cause a denial of service. **Recommendations** For GlusterFS version 11.0, consider disabling the `dht setxattr mds cbk` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.5.1.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash. This is related to a memory allocation failure in the AP4 CttsAtom class, located in Core/Ap4CttsAtom.cpp. The vulnerability can be demonstrated using mp2aac. **Recommendations** For Bento4 version 1.5.1.0, consider updating to a newer version that addresses the memory allocation failure issue in the AP4 CttsAtom class. As a temporary workaround, restrict the use of the AP4 CttsAtom class to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tcpreplay version 4.3.2 **Description** The issue is related to a buffer overflow in the `do checksum` function of the `checksum.c` component in the Tcpreplay utility. This can be exploited by a remote attacker using a specially crafted pcap file, leading to a denial of service. The exploitation occurs when the `tcpreplay-edit` binary processes the malicious pcap file. **Recommendations** For Tcpreplay version 4.3.2, consider disabling the `do checksum` function as a temporary workaround until a patch is available. Restrict access to the `tcpreplay-edit` binary to minimize the risk of exploitation. Avoid using the `tcpreplay-edit` binary with untrusted pcap files until the issue is resolved.