Alfredo Ortega

**Name of the Vulnerable Software and Affected Versions** W3C Amaya Web Browser versions 10.0 through 11.0 **Description** The issue is related to multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved via a long `type` parameter in an `input` tag, which is not properly handled by the `EndOfXmlAttributeValue` function, or an "HTML GI" in a start tag, which is not properly handled by the `ProcessStartGI` function. Additionally, there are unspecified vectors in `html2thot.c` and `xml2thot.c` related to the `msgBuffer` variable. **Recommendations** For W3C Amaya Web Browser versions 10.0 through 11.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Qemu versions 0.9.1 and earlier KVM versions kvm-79 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, by sending a certain message. This is due to a problem in the `protocol client msg` function in the VNC server. Recommendations: For Qemu versions 0.9.1 and earlier, update to a version later than 0.9.1 to resolve the issue. For KVM versions kvm-79 and earlier, update to a version later than kvm-79 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Vinagre versions prior to 0.5.2 Vinagre versions 2.x prior to 2.24.2 **Description** The issue is related to a format string vulnerability in the `vinagre utils show error` function, which may allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response. This could lead to a breach of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely. **Recommendations** For Vinagre versions prior to 0.5.2, update to version 0.5.2 or later. For Vinagre versions 2.x prior to 2.24.2, update to version 2.24.2 or later.

**Name of the Vulnerable Software and Affected Versions** BigView version 1.8 **Description** The issue is related to a stack-based buffer overflow in the getline function, which can be exploited by user-assisted remote attackers. This is achieved through a crafted PNM file, allowing the execution of arbitrary code. **Recommendations** For BigView version 1.8, update to a version that fixes the stack-based buffer overflow in the getline function, if available. As a temporary workaround, consider restricting the use of the getline function in Ppm/ppm.C to minimize the risk of exploitation. Avoid using BigView to open crafted PNM files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Common Data Format (CDF) library versions prior to 3.2.1 **Description** The issue is related to a stack-based buffer overflow in the `Read32s 64` function, which can be exploited by context-dependent attackers to execute arbitrary code. This can be achieved through a .cdf file containing crafted length tags. **Recommendations** For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of .cdf files from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Android SDK versions m3-rc37a and earlier **Description** The issue is related to a heap-based buffer overflow in the GIF library within the WebKit framework. This can be exploited by remote attackers through a crafted GIF file, where the logical screen height and width differ from the actual height and width, potentially allowing the execution of arbitrary code. **Recommendations** For Android SDK versions m3-rc37a and earlier, update to a version later than m3-rc37a to resolve the issue.