These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A stack out-of-bounds read vulnerability exists in vgmstream through r2117 in the G.722.1/Siren14 decoder. This issue allows attackers to supply crafted .s14 or .sss files that can cause the application to crash during format detection. The vulnerability is caused by the bit reader refills without checking the data_u32 array end, leading to a potential denial-of-service (DoS) scenario. Defenders should pr [truncated]
A vulnerability was detected in vgmstream up to r2117, affecting the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler, leading to an out-of-bounds read. The attack is possible to be carried out remotely. A patch is available, named 4b8316652a30d40f99ad43310bed273fd1f8a7a3. Defenders should assess exposure and apply the patch or update to a version beyond r211 [truncated]
A security vulnerability has been detected in vgmstream up to r2117, affecting the function decode_ms_ima of the file src/coding/ima_decoder.c in the Microsoft IMA Decoder component. This vulnerability leads to a divide by zero condition and can be exploited remotely. Defenders should verify the version in use and assess exposure to remote attacks as part of their security protocols. This involves reviewi [truncated]
A security flaw has been discovered in vgmstream up to r2117, affecting the function parse_params/txtp_parse of the file src/meta/txtp_parser.c in the TXTP File Handler component. This vulnerability allows for remote out-of-bounds write attacks. The patch identified as 4669d37a6af94866f6f0628678f9f90d46954e8b should be applied to resolve the issue. Defenders should assess exposure and apply the patch. The [truncated]
A weakness has been identified in vgmstream up to r2117, specifically in the make_group_random function of the src/meta/txtp_process.c file in the TXTP File Handler component. This manipulation leads to a use after free vulnerability, which requires local attack vector. The recommended patch has been applied with the name ae37662ad626254ddd96ad69ac263792d7a92024.
A weakness was identified in vgmstream up to r2117, specifically in the vadpcm_read_coefs_be function of the src/coding/vadpcm_decoder.c file, which is part of the EA SCHl parser. This weakness leads to an out-of-bounds write vulnerability when manipulating the argument entry/entries. The vulnerability can be exploited remotely. A patch (ae37662ad626254ddd96ad69ac263792d7a92024) has been suggested to addr [truncated]
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a [truncated]
A weakness has been identified in vgmstream up to r2117, specifically in the function sscanf of the file src/meta/txth.c of the component txth-txtp, which can cause a stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. To fix this issue, it is recommended to deploy a patch named 4669d37a6af94866f6f [truncated]
