CWE-762

There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.

Biblioteka llama.cpp w wersjach b1886–b7445 zawiera podatność typu double free w warstwie JNI dla systemu Android, wynikającą z niezgodności mechanizmów alokacji i zwalniania pamięci. Błąd może prowadzić do awarii procesu (DoS) lub potencjalnie do wykonania dowolnego kodu (RCE).

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper memory deallocation checking, which can result in a UAF (Use-After-Free) vulnerability.

Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.

T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error.

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper memory management when Cisco IOS XE Software is processing Address Resolution Protocol (ARP) messages. An attacker could exploit this vulnerability by sending crafted ARP messages at a high rate over a period of time to an affected device. A successful exploit could allow the attacker to exhaust system resources, which eventually triggers a reload of the active route switch processor (RSP). If a redundant RSP is not present, the router reloads.

Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file

Problem w obsłudze pamięci w editcap może spowodować denial of service poprzez specjalnie przygotowany plik przechwytywania.

W bibliotece spiral-rs wersja 0.2.0 dla Rusta może dojść do próby alokacji dla ZST (zero-sized type).

Plik lib.rs w cracku trailer w wersji 0.1.2 dla Rust niepoprawnie obsługuje alokację pamięci o rozmiarze zero.

W OGRECave Ogre do wersji 14.4.1 zidentyfikowano słabość w funkcji STBIImageCodec::encode w pliku /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Podatność prowadzi do niezgodności w rutynach zarządzania pamięcią i wymaga lokalnego dostępu. Exploit został ujawniony publicznie.