Colin Percival

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows Apple Safari versions prior to 4.1 on Mac OS X 10.4 **Description** The issue allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging when an https to http redirection occurs. This happens because the software sends an https URL in the Referer header of an http request under certain circumstances. **Recommendations** For Apple Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows, update to version 5.0 or later. For Apple Safari versions prior to 4.1 on Mac OS X 10.4, update to version 4.1 or later.

Name of the Vulnerable Software and Affected Versions: libarchive versions prior to 2.2.4 bsdtar (affected versions not specified) Description: The issue concerns multiple vulnerabilities in the libarchive package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities can be triggered by a crafted PAX or TAR archive, potentially leading to a denial of service or the execution of arbitrary code. The exploitation can be performed remotely. Recommendations: For libarchive versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. For bsdtar, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libarchive versions prior to 2.2.4 Description: The issue allows user-assisted remote attackers to cause a denial of service via specific conditions in tar headers or malformed pax extension headers in PAX or TAR archives, resulting in a NULL pointer dereference. Multiple vulnerabilities in the libarchive package can lead to violations of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Recommendations: For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of libarchive functions that handle tar and pax headers until a patch is available. Avoid using the `archive read support format tar` function in `archive read support format tar.c` until the issue is resolved.

An unspecified kernel interface in Mac OS X 10.4.2 and earlier does not properly clear memory before reusing it, which could allow attackers to obtain sensitive information, a different vulnerability than CVE-2005-1126 and CVE-2005-1406.

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 4.x through 4.11 FreeBSD versions 5.x through 5.4 Description: The issue is related to the kernel in FreeBSD not properly clearing certain fixed-length buffers when copying variable-length data for use by applications. This could allow applications to read previously used sensitive memory. Recommendations: For versions 4.x through 4.11, update to a version that properly clears fixed-length buffers. For versions 5.x through 5.4, update to a version that properly clears fixed-length buffers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions 4.x through 4.11 FreeBSD versions 5.x through 5.4 **Description** The issue is related to the SIOCGIFCONF ioctl, specifically the ifconf function, which does not properly clear a buffer before using it. This allows local users to obtain portions of sensitive kernel memory. **Recommendations** For FreeBSD versions 4.x through 4.11, update to a version outside of this range to resolve the issue. For FreeBSD versions 5.x through 5.4, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the ifconf function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** The issue allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys. This is achieved via a timing attack on memory cache misses, exploiting Hyper-Threading technology used in operating systems run on Intel Pentium and other processors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.