Quang Nguyen

**Name of the Vulnerable Software and Affected Versions** D-Link DAP-2020 version 1.01rc001 **Description** The issue is related to a stack-based buffer overflow when handling the `var:page` parameter provided to the "webproc" endpoint. This occurs due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For D-Link DAP-2020 version 1.01rc001, as a temporary workaround, consider restricting access to the "webproc" endpoint until a patch is available. Avoid using the `var:page` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DAP-2020 version 1.01rc001 **Description** The issue is related to a stack-based buffer overflow when handling the `var:menu` parameter provided to the "webproc" endpoint. This occurs due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. No authentication is required to exploit this vulnerability. **Recommendations** For D-Link DAP-2020 version 1.01rc001, as a temporary workaround, consider disabling the `webproc` endpoint until a patch is available. Restrict access to the `var:menu` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SDL (Simple DirectMedia Layer) versions 2.x through 2.0.9 **Description** The issue is related to a heap-based buffer over-read in Fill IMA ADPCM block, caused by an integer overflow in the `IMA ADPCM decode()` function in audio/SDL wave.c. This can be exploited by a remote attacker using a specially crafted file, potentially leading to a denial of service. **Recommendations** For versions 2.x through 2.0.9, consider disabling the `IMA ADPCM decode()` function as a temporary workaround until a patch is available. Restrict access to the audio/SDL wave.c component to minimize the risk of exploitation. Avoid using the `Fill IMA ADPCM block` function in the affected SDL versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Little CMS version 2.9 **Description** The issue is related to an integer overflow in the `AllocateDataSet` function in `cmscgats.c`, which leads to a heap-based buffer overflow in the `SetData` function. This can be triggered via a crafted file passed as the second argument to `cmsIT8LoadFromFile`, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code. **Recommendations** For Little CMS version 2.9, consider disabling the `AllocateDataSet` function or restricting the use of `cmsIT8LoadFromFile` until a patch is available to prevent potential exploitation.