Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
U-Boot's IP fragment reassembly writes into the reassembly buffer using attacker-controlled fragment offset and length without adequate bounds checking, so a crafted fragmented packet sent during netboot writes out of bounds and corrupts adjacent memory.
U-Boot's RLE8 bitmap decoder does not bound its writes to the framebuffer, so a crafted RLE8-compressed BMP decoded during boot writes past the end of the framebuffer and corrupts adjacent memory inside the bootloader.
A size computation for the SquashFS directory table overflows on an attacker-controlled superblock field, producing an undersized allocation and subsequent out-of-bounds writes when U-Boot parses a crafted SquashFS image during boot.
U-Boot's NFS client stores the server-supplied READ length in a signed integer and bounds it with a pointer-difference check that a negative length passes, then copies it as an unsigned length, so a malicious NFS server can drive an approximately 2 GB out-of-bounds write.
U-Boot's NFS client takes the symlink length from a READLINK reply into a signed integer with no lower-bound check, so a negative length bypasses the capacity guard and is then used as an unsigned copy size, giving a malicious NFS server an out-of-bounds write off the path buffer.
On a storage failure U-Boot's lwIP wget receive callback aborts and frees the TCP connection but returns the wrong status code, so the lwIP TCP input path keeps using the freed connection object, a use-after-free reachable from a malicious HTTP server.
U-Boot's DHCPv6 client takes the SERVERID and CLIENTID option lengths from a received packet without validation, so an on-link attacker answering the client's SOLICIT can overrun the transmit buffer with the saved server DUID and read past the client DUID buffer.
The Android bootmeth read size is taken from the untrusted boot-image header and is not bounded by the partition size, so a crafted image with an oversized header makes the block read overrun the load buffer on devices where Android Verified Boot does not gate the read.
The lwIP MQTT client does not enforce the MQTT limit on fixed-header length, so a malicious or man-in-the-middle broker can send a run of remaining-length continuation bytes and drive an unbounded write past a 128-byte heap buffer in the client. No MQTT authentication is required, and the primitive is a plausible path to remote code execution.
Unchecked src_len in the RSA NOPAD paths underflows the copy destination, writing attacker-controlled bytes below the core heap buffer.
TA_FLAG_CONCURRENT is accepted from user TA headers, letting two sessions race on one shared context and free vm_region nodes that are still in use.
Unchecked src_len in the SE050 driver's RSA NOPAD paths underflows the copy destination, writing attacker-controlled bytes below the core heap buffer.
The Widevine PTA's open_session dereferences ts_get_calling_session() without a NULL check, so a direct Normal World session panics the Secure World.
sppp_pap_input uses attacker-controlled length fields directly as bcmp comparison length, allowing zero-length authentication bypass.
mpls_do_error copies (nstk+1) label-stack entries from a fixed 16-entry array when no BoS label is present, leaking 4 bytes of adjacent kernel stack memory in the ICMP/MPLS error response.
The report.test trapper endpoint allows an authenticated low-privilege user to supply an arbitrary userid in the request body. The server creates a real session for that user, renders their dashboard as a PDF, and emails it to the attacker — with no check that the requested viewer identity matches the authenticated caller.
Zabbix server takes access_token and refresh_token values directly from an external OAuth server's HTTP response and interpolates them into a SQL UPDATE with no escaping. Stacked queries are enabled, giving an attacker who controls the token endpoint arbitrary SQL execution against the Zabbix database.
SSH connection reuse matching in libcurl does not verify SSH authentication context.
Zabbix MFA enforcement is bypassed when logging in via HTTP Basic Auth or SAML SSO paths, which create fully active sessions without triggering the MFA challenge.
An unchecked copy length derived from parsed network input causes a stack out-of-bounds write in the wlscan ASP handler.
A non-atomic stat/unlink/fopen sequence on a fixed path in /var/tmp is exploitable via symlink substitution.
Error sentinel values from web_read are propagated as unsigned size arguments to f_write, enabling oversized memory operations.
Attacker-controlled filename input reaches fopen and unlink calls without canonicalization or directory confinement.
User-controlled CGI parameters and request-derived buffers are embedded into shell command strings and executed without sanitization.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.