Ben Laurie

**Name of the Vulnerable Software and Affected Versions** Sandstorm Cap'n Proto versions prior to 0.4.1.1 Sandstorm Cap'n Proto versions 0.5.x prior to 0.5.1.1 **Description** The issue is related to an integer overflow in the layout.c++ file, which can be exploited by remote peers via a crafted message. This could lead to a denial of service or potentially allow access to sensitive information from memory, due to inadequate pointer validation. **Recommendations** For Sandstorm Cap'n Proto versions prior to 0.4.1.1, update to version 0.4.1.1 or later. For Sandstorm Cap'n Proto versions 0.5.x prior to 0.5.1.1, update to version 0.5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Sandstorm Cap'n Proto versions prior to 0.4.1.1 Sandstorm Cap'n Proto versions 0.5.x prior to 0.5.1.1 **Description** The issue allows remote peers to cause a denial of service, potentially consuming CPU and other system resources, by sending a list with a large number of elements. **Recommendations** For versions prior to 0.4.1.1, update to version 0.4.1.1 or later. For versions 0.5.x prior to 0.5.1.1, update to version 0.5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Cyberoam UTM appliances (affected versions not specified) **Description** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations. This makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the `Cyberoam SSL CA` certificate in a list of trusted root certification authorities. The vendor disputes the significance of this issue, citing that the appliance does not allow import or export of the private key. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 0.9.7 through 0.9.7j OpenSSL versions 0.9.8 through 0.9.8b Description: The issue allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by an RSA key with exponent 3, preventing OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1. This could lead to unauthorized access to certificate-protected resources. The vulnerability affects PKCS #1 v1.5 signatures if the exponent of the public key is 3, which is widely used by Certificate Authorities. An attacker will likely exploit this vulnerability to forge signatures without the secret key. Recommendations: For OpenSSL versions 0.9.7 through 0.9.7j, update to version 0.9.7k or later. For OpenSSL versions 0.9.8 through 0.9.8b, update to version 0.9.8c or later. As a temporary workaround, consider restricting the use of RSA keys with exponent 3 until a patch is available.