Vulnerabilidades

*** Pendiente de traducción *** When decoding an OpenEXR file that uses DWAA or DWAB compression, there&amp;#39;s an implicit assumption that all image channels have the same pixel type (and size), and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decode_header. The buffer td-&gt;uncompressed_data is allocated in decode_block based on the xsize, ysize and computed current_channel_offset.<br /> <br /> The function dwa_uncompress then assumes at [5] that if there are 4 channels, these are "B", "G", "R" and "A", and in the calculations at [6] and [7] that all channels are of the same type, which matches the type of the main color channels.<br /> <br /> If we set the main color channels to a 4-byte type and add duplicate or unknown channels of the 2-byte EXR_HALF type, then the addition at [7] will increment the pointer by 4-bytes * xsize * nb_channels, which will exceed the allocated buffer.<br /> <br /> <br /> <br /> <br /> <br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion stored_frame. Stored frames can later be referenced by FTCH chunks. For files using subversion stored_frame. Leaving ctx-&gt;has_dimensions set to false.<br /> <br /> A subsequent chunk with type FTCH would call process_ftch and decode that frame obj again, adding to the top/left values and calling process_frame_obj again.<br /> Given that we never set ctx-&gt;have_dimensions before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx-&gt;stored_frame, freeing the previous one. However, the GetByteContext object gb still holds a reference to the old buffer.<br /> <br /> <br /> <br /> <br /> Finally, when the code tries to decode the frame, codecs that accept a GetByteContext as a parameter will trigger a use-after-free read when using gb.<br /> <br /> GetByteContext is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free and when the object is accessed. However, upon returning to process_ftch, the code restores the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator’s metadata.<br /> <br /> This issue can be triggered just by probing whether a file has the sanm format.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** When calculating the content path in handling of MPEG-DASH manifests, there&amp;#39;s an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not &amp;#39;/&amp;#39; then we append &amp;#39;/&amp;#39; in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.<br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** When parsing the header for a DHAV file, there&amp;#39;s an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer.<br /> <br /> If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000.<br /> <br /> The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we&amp;#39;ll calculate end_pos based on a 32-bit offset read from the buffer.<br /> <br /> There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation.<br /> <br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.<br /> <br /> Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.<br /> <br /> This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.<br /> <br /> process_frame_obj initializes the buffers based on the frame resolution:<br /> <br /> <br /> <br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.<br /> <br /> We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td-&gt;rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td-&gt;xsize - 1) * (td-&gt;ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.<br /> <br /> <br /> <br /> <br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** When decoding an OpenEXR file that uses DWAA or DWAB compression, there&amp;#39;s an implicit assumption that the height and width are divisible by 8.<br /> <br /> If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8.<br /> <br /> The buffer td-&gt;uncompressed_data is allocated in decode_block based on the precise height and width of the image, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can corrupt following heap memory.<br /> <br /> <br /> <br /> We recommend upgrading to version 8.0 or beyond.

*** Pendiente de traducción *** A security vulnerability has been detected in Tenda AC18 15.03.05.19(6318). This vulnerability affects unknown code of the file /goform/SetUpnpCfg. The manipulation of the argument upnpEn leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

*** Pendiente de traducción *** A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing manipulation of the argument wifi_chkHz can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.

*** Pendiente de traducción *** A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.

*** Pendiente de traducción *** JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.

*** Pendiente de traducción *** The credentials of the users stored in the system&amp;#39;s local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.