BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type "binary"). The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.

Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

Azure CLI Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

Windows Domain Name Service Remote Code Execution Vulnerability

Out-of-bounds write in DNS Server allows an authorized attacker to execute code over a network.

Azure CycleCloud Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)

Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application. Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.

Premiere Pro | Out-of-bounds Write (CWE-787)

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR

NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.

Heap-based Buffer Overflow in Git

Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Emacs: emacs: command injection via crafted filenames in tramp

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.