[DNS transaction ID is sequential -- enables response injection]

[NDP RA allows any value for MTU]

[mg_tls_recv_cert certificate chain length unchecked -- OOB read]

[TLS certificate notAfter validated against hardcoded 2025-01-01 string]

[RSA-PSS CertificateVerify checks only 0xbc trailer]

[mg_der_to_tlv long-form DER length OOB read]

[mg_der_find_oid unbounded recursion on constructed DER tags]

[skip_chunk off-by-one OOB read in chunked HTTP CRLF check]

[mg_der_to_tlv long-form DER length OOB read]

[find_opt zero-length PPP option -- infinite loop]

[rx_ip6 IPv6 extension header OOB read; 16-bit len wrap]

[mg_tls_parse_cert_der pubkey BIT STRING length underflow -- OOB read]

[mg_tls_server_recv_hello session_id_len OOB read]

[precompute_slide_window NULL deref on OOM / more_comps NULL deref after failed calloc / bi_initialize / alloc NULL deref on OOM]

[MQTT v5 properties bounds check uses relative offset against absolute position]

[w5100_rx wraparound RX path copies n instead of r bytes]

(An issue in kamailio v.6.1.1 and before allows a remote attacker to ca ...)

(An issue in kamailio v.6.1.1 and before allows a remote attacker to ca ...)

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication if the public CA key used is also known. This affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled.