Damien Miller

**Nome do software vulnerável e versões afetadas** Versões do OpenSSH de 5.7 a 8.4 **Descrição** O lado do cliente no OpenSSH apresenta uma discrepância observável que leva a um vazamento de informações na negociação do algoritmo. Isso permite que invasores do tipo “man-in-the-middle” ataquem tentativas de conexão iniciais nas quais nenhuma chave de host do servidor foi armazenada em cache pelo cliente. **Recomendações** Para as versões 5.7 a 8.4 do OpenSSH, atualize para uma versão posterior à 8.4 para resolver o problema. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Dropbear SSH versions prior to 2016.72 **Description** The issue allows remote authenticated users to bypass intended shell-command restrictions. This is achieved by sending crafted X11 forwarding data, exploiting a CRLF injection vulnerability. **Recommendations** For versions prior to 2016.72, update to version 2016.72 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mathTeX versions prior to 20090713 **Description** The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `dpi` tag, specifically within the `getdirective` function in `mathtex.cgi`. **Recommendations** For versions prior to 20090713, update to a version released after 20090713 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mathTeX versions prior to 20090713 **Description** The issue is related to multiple stack-based buffer overflows in the mathtex.cgi component of mathTeX. This has an unspecified impact and can be exploited through remote attack vectors. **Recommendations** For versions prior to 20090713, update to a version released after 20090713 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mathTeX versions prior to 20090713 **Description** The issue is related to the insecure creation of temporary files by mathtex.cgi in mathTeX, which has an unspecified impact and can be exploited through local attack vectors. **Recommendations** For versions prior to 20090713, update to a version released after 20090713 to resolve the issue.