Threats tagged 'ghsa-gr3p-v4fr-f93c'

The Sleuth Kit versions up to 4.15.0 have a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. This flaw allows attackers to crash the tool by providing a specially crafted HFS+ image with a manipulated LZVN inline com.apple.decmpfs attribute. The vulnerability leads to denial of service due to a failed allocation and subsequent NULL pointer write.