Bincookie
Monthly
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.