A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

(Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an atta ...)

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

(llama.cpp through commit 97f06e9, when started with the --reranking fl ...)

(llama.cpp b5693 and before has a Reachable Assertion via the gguf_read ...)

(llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in ...)

[ENET_IRQHandler RX descriptor not re-owned on error -- RX ring stall]

[opendir() stack overflow via wcscat on MAX_PATH path]

[cyw_spi_tx SPI alignment padding indexes uint32_t* buffer with byte offset]

[mg_random rand() fallback used for TLS secrets]

[ppp_handle_ipcp attacker-controlled IPCP length -- OOB read]

[mg_tls_client_recv_hello size_t underflow in ext_len bounds check / mg_tls_client_recv_hello ext_len fixed-offset OOB read]

[mg_tls_verify_cert_signature OOB read for short ECDSA integers]

[rx_ndp_ns ICMPv6 NS minimum length insufficient -- OOB read]

[rx_dhcp_client 32-bit overflow in DHCP lease millisecond conversion]

[rx_ndp_na NDP NA missing option length check -- OOB read]

[rx_ip truncated DHCP options size_t underflow OOB read]

[TLS certificate notAfter validated against hardcoded 2025-01-01 string]

[mg_tls_client_recv_hello key_share extension OOB read]