Memory disclosure and hang via unchecked SUSP lengths

Out-of-bounds reads in The Sleuth Kit through 4.14.0 allow attackers to disclose process memory or hang analysis via a crafted ISO image. The ISO9660 parse_susp() function copies Extension Reference strings using image-supplied len_id, len_des, and len_src values without confirming each source range remains inside the parsed SUSP block, while a zero-length entry prevents parser advancement. Exploitation requires a user or consuming application to analyze the malicious image; the grounded effects are out-of-range memory reads and an infinite parsing loop, not data modification or code execution.