Tygls

**Name of the Vulnerable Software and Affected Versions** Open Asset Import Library Assimp versions prior to 6.0.5 **Description** A double free issue exists in the PLY Model Handler component within the `Assimp::Exporter::ExportToBlob()` function located in the `code/AssetLib/Ply/PlyLoader.cpp` file. This flaw allows a remote attacker to trigger a double free, which occurs when the program attempts to free the same memory location twice, potentially leading to a crash or arbitrary code execution. **Recommendations** Update Open Asset Import Library Assimp to version 6.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Open Asset Import Library Assimp versions prior to 6.0.6 **Description** A heap-based buffer overflow occurs in the CSM File Handler component. The issue resides in the `Assimp::CSMImporter::InternReadFile()` function within the `code/AssetLib/CSM/CSMLoader.cpp` file. This flaw allows for local execution to trigger the overflow. **Recommendations** Apply patch eb84eec580d3f4ba2f0fd87409b7d0744620f11e to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Open Asset Import Library Assimp versions prior to 5.4.4 **Description** An issue exists in the Model File Handler component within the `Assimp::SceneCombiner::Copy()` function located in the `code/Common/SceneCombiner.cpp` file. A heap-based buffer overflow occurs when the `width` and `height` arguments are manipulated. This flaw requires local access to be exploited. **Recommendations** Update Open Asset Import Library Assimp to version 5.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** seladb PcapPlusPlus version 25.05 **Description** A heap-based buffer overflow exists in the Telnet Subnegotiation Packet Handler component. The issue occurs within the `getSubCommand()` function located in the `Packet++/src/TelnetLayer.cpp` file. This flaw allows a remote attacker to trigger the overflow through manipulation, although the attack complexity is high and exploitability is considered difficult. **Recommendations** Apply patch 98e671010bc7c87b95898c22ae289220ae92542b to resolve the issue in version 25.05.

**Name of the Vulnerable Software and Affected Versions** seladb PcapPlusPlus version 25.05 **Description** A heap-based buffer overflow exists in the Modbus Protocol Handler component within the `Packet++/header/ModbusLayer.h` library. The issue occurs when the `pcpp::ModbusLayer::getLength()` function processes a manipulated `length` argument. This flaw allows for remote attacks, although they are characterized by high complexity and difficult exploitability. **Recommendations** Apply patch 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454 to version 25.05.

**Name of the Vulnerable Software and Affected Versions** llvm-project versions prior to 22.1.7 **Description** A stack-based buffer overflow occurs in the ValueSymbolTable Module within the library `/lib/IR/ValueSymbolTable.cpp`. The issue is triggered by the `llvm::StringMap::insert()` function. Successful exploitation requires local access to the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict local access to the system to prevent exploitation of the `llvm::StringMap::insert()` function.

**Name of the Vulnerable Software and Affected Versions** llvm-project versions prior to 22.1.7 **Description** A heap-based buffer overflow occurs in the Bitcode File Handler component within the library llvm/lib/IR/IntrinsicInst.cpp. The issue is located in the `GCRelocateInst::getBasePtr()` function and can be exploited by a local attacker. **Recommendations** Update llvm-project to version 22.1.7 or later. As a temporary mitigation, restrict access to the `GCRelocateInst::getBasePtr()` function.

**Name of the Vulnerable Software and Affected Versions** seladb PcapPlusPlus version 25.05 **Description** A heap-based buffer overflow exists in the LightPcapNg Parser component within the `parse by block type()` function of the `light pcapng.c` file. This issue occurs when the `captured packet length` argument is manipulated, allowing a remote attacker to trigger the overflow. The attack is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict the use of the `parse by block type()` function within the LightPcapNg Parser.

**Name of the Vulnerable Software and Affected Versions** seladb PcapPlusPlus version 25.05 **Description** A heap-based buffer overflow exists in the TLS Hello Handler component. The issue occurs within the `pcpp::SSLClientHelloMessage::getHandshakeVersion()` function located in the `Packet++/src/SSLHandshake.cpp` file. A remote attacker can trigger this by manipulating the `handshakeVersion` argument. This attack is characterized by high complexity and is considered difficult to exploit. **Recommendations** Apply patch 98e671010bc7c87b95898c22ae289220ae92542b to version 25.05.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** An out-of-bounds read occurs in the Half-Life 1 MDL Loader component within the `HL1MDLLoader::read sequence infos()` function of the HL1MDLLoader.cpp file. This issue is triggered by the manipulation of the `aiString` argument and requires local access to be exploited. **Recommendations** Update to version 6.0.5 or later. As a temporary workaround, restrict the use of the `HL1MDLLoader::read sequence infos()` function.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A heap-based buffer overflow occurs in the Half-Life 1 MDL Loader component. The issue is located within the `read meshes()` function of the HL1MDLLoader.cpp file. This flaw allows for local execution of an attack. **Recommendations** Update to version 6.0.5 or later. As a temporary workaround, restrict the use of the Half-Life 1 MDL Loader component.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A heap-based buffer overflow occurs in the Half-Life 1 MDL Loader component within the `read animations()` function of the HL1MDLLoader.cpp file. This issue requires local access to be exploited. **Recommendations** Update to version 6.0.5 or later. As a temporary workaround, restrict the use of the `read animations()` function in the Half-Life 1 MDL Loader component.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A heap-based buffer overflow occurs in the Half-Life 1 MDL Loader component within the `HL1MDLLoader::extract anim value()` function of the HL1MDLLoader.cpp file. This issue is triggered by manipulating the `num.total` argument and requires the attack to be initiated from a local position. **Recommendations** Update to version 6.0.5 or later. As a temporary workaround, restrict the use of the Half-Life 1 MDL Loader component.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A use after free issue exists in the ASE File Parser component within the `aiNode::~aiNode()` function of the scene.cpp file. This flaw allows a local attacker to execute a manipulation that leads to the use of memory after it has been freed. **Recommendations** Update to version 6.0.5 or later. As a temporary workaround, restrict the use of the ASE File Parser component.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A null pointer dereference occurs in the TF File Handler component within the `glTF2Importer::ImportEmbeddedTextures()` function located in the `code/AssetLib/glTF2/glTF2Importer.cpp` library file. This issue can be triggered through local access by manipulating the input processed by the function. **Recommendations** Apply the available patch to resolve the issue. As a temporary mitigation, restrict local access to the `glTF2Importer::ImportEmbeddedTextures()` function.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A null pointer dereference occurs in the `glTFImporter` component within the `Assimp::glTFImporter::ImportMeshes()` function of the `glTFImporter.cpp` file. This issue allows for local execution attacks. **Recommendations** Update to a version later than 6.0.4. As a temporary workaround, restrict the use of the `Assimp::glTFImporter::ImportMeshes()` function.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A null pointer dereference occurs in the `glTF2::LazyDict` function within the `glTF2Asset.h` library. This issue is triggered by the manipulation of the `operator[]` argument and requires local access to be exploited. **Recommendations** Apply patch d24b85319bd70c65883a2b96613e07e23fb95981 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A heap-based buffer overflow exists in the 4x4 Matrix Parser component within the `glTFCommon.h` library. This issue occurs in the `glTFCommon::CopyValue()` function and can be triggered by a local attacker through specific manipulation, potentially allowing for arbitrary code execution. **Recommendations** Update to version 6.0.5 or later. As a temporary workaround, restrict the use of the `glTFCommon::CopyValue()` function in the 4x4 Matrix Parser component.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 6.0.5 **Description** A divide by zero error exists in the UV Channel Handler component within the `FBXExporter::WriteObjects()` function of the `FBXExporter.cpp` file. This issue can be triggered through local manipulation. **Recommendations** Update to a version later than 6.0.4 to resolve this issue. As a temporary mitigation, restrict the use of the `FBXExporter::WriteObjects()` function.

**Name of the Vulnerable Software and Affected Versions** ggml-org llama.cpp versions prior to 55abc39 **Description** A flaw exists in the GBNF Grammar Handler component of ggml-org llama.cpp. Specifically, the `llama grammar advance stack` function within the `llama.cpp/src/llama-grammar.cpp` file is susceptible to a stack-based buffer overflow. This manipulation requires local access to launch the attack. An exploit for this issue has been published. **Recommendations** Apply patch 18993.