Zounathan

**Name of the Vulnerable Software and Affected Versions** libyang versions prior to 1.0.225 **Description** The issue is related to a stack overflow in the libyang library, which can cause a denial of service. This occurs due to uncontrolled recursion of the `lyxml parse elem()` function when `lyxml parse mem()` is called. The exploitation of this issue can allow a remote attacker to cause a denial of service. **Recommendations** For versions prior to 1.0.225, update to version 1.0.225 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `lyxml parse mem()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libyang versions prior to 1.0.226 **Description** The issue is related to the function `lys node free()` in the libyang library, where it incorrectly asserts that the value of `node->module` cannot be NULL. However, in certain cases, `node->module` can indeed be null, leading to a reachable assertion. This can potentially allow a remote attacker to cause a denial of service. **Recommendations** For libyang versions prior to 1.0.226, update to version 1.0.226 or later to resolve the issue. As a temporary workaround, consider modifying the `lys node free()` function to properly handle cases where `node->module` is null, until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libyang versions prior to 1.0.225 **Description** The issue is related to the function `ext get plugin()` in the libyang library, where it fails to check if the `revision` value is NULL. This oversight can lead to a crash when the `strcmp` function is called with a NULL `revision` argument. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For libyang versions prior to 1.0.225, consider adding a NULL check for the `revision` variable before calling the `strcmp` function to prevent the crash. As a temporary workaround, restrict the use of the `ext get plugin()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libyang versions prior to 1.0.226 **Description** The issue is related to the function `read yin container()` in the libyang library, which fails to check if the value of `retval->ext[r]` is NULL. This can lead to a crash when attempting to access `retval->ext[r]->flags` if `retval->ext[r]` is NULL. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For libyang versions prior to 1.0.226, update to version 1.0.226 or later to resolve the issue. As a temporary workaround, consider adding a NULL check for `retval->ext[r]` before accessing its members to prevent the crash.

**Name of the Vulnerable Software and Affected Versions** libyang versions prior to 1.0.226 **Description** The issue is related to the function `read yin leaf()` in the libyang library, which fails to check if the value of `retval->ext[r]` is NULL. This can lead to a crash when attempting to access `retval->ext[r]->flags` when `retval->ext[r]` is NULL. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For libyang versions prior to 1.0.226, update to version 1.0.226 or later to resolve the issue. As a temporary workaround, consider adding a NULL check for `retval->ext[r]` before accessing its members to prevent the crash.

**Name of the Vulnerable Software and Affected Versions** Live555 version 0.95 **Description** The issue is related to a buffer overflow caused by a large integer in a Content-Length HTTP header. This occurs because the `handleRequestBytes` function has an unrestricted `memmove`. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Live555 version 0.95, consider restricting the use of the `handleRequestBytes` function until a patch is available to prevent potential buffer overflow attacks. Additionally, limiting the size of integers accepted in the Content-Length HTTP header can help mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Live555 version 0.95 **Description** A memory leak can occur due to a setup packet, potentially leading to a denial of service (DoS) because when there are multiple instances of certain fields, such as `username`, `realm`, `nonce`, `uri`, or `response`, only the last instance can be freed. **Recommendations** For Live555 version 0.95, consider restricting the handling of setup packets to prevent the memory leak until a fix is available. As a temporary workaround, review the code to ensure proper memory management for multiple instances of fields like `username`, `realm`, `nonce`, `uri`, or `response`.