Frédéric Desbiens

NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

NULL pointer dereference when evicting the last MSRP attribute in a participant's list

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

The FTP client trusts arbitrary IP addresses in the PASV server response

TFTP client and server copy the ERROR packet message without bounding the read against the packet

DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer