Lion

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to an out-of-bounds write vulnerability in the Linux kernel's net/sched: sch qfq component. This vulnerability can be exploited to achieve local privilege escalation. The `qfq change agg()` function in net/sched/sch qfq.c allows an out-of-bounds write because `lmax` is updated according to packet sizes without bounds checks. **Recommendations** Upgrade past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `qfq change agg()` function until a patch is available.

**Nome do software vulnerável e versões afetadas** Versões do Telerik Fiddler anteriores à 5.0.20204 **Descrição** A vulnerabilidade permite que invasores executem programas arbitrários por meio de um nome de host com um espaço à direita, seguido por --utility-and-browser --utility-cmd-prefix= e o caminho de um programa instalado localmente. A vítima deve selecionar interativamente a opção “Abrir no navegador”. **Recomendações** Para versões anteriores à 5.0.20204, atualize para a versão 5.0.20204 ou posterior para resolver o problema. Como solução alternativa temporária, considere evitar o uso da opção “Abrir no navegador” para nomes de host com caracteres suspeitos. Restrinja o acesso a programas instalados localmente para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Titan FTP versions 3.21 and earlier **Description** A heap-based buffer overflow issue allows remote attackers to cause a denial of service (crash) via a long FTP command, such as `CWD`, `STAT`, or `LIST`. **Recommendations** For versions 3.21 and earlier, update to a version later than 3.21 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WFTPD Pro Server version 3.21 **Description** The issue allows remote authenticated users to cause a denial of service, resulting in a crash, by sending a series of long MLIST commands. **Recommendations** For WFTPD Pro Server version 3.21, consider restricting access to the MLIST command as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WS FTP version 5.0.2 **Description** The issue allows remote authenticated users to cause a denial of service, specifically CPU consumption, by sending a CD command with an invalid path containing a "../" sequence. **Recommendations** For WS FTP version 5.0.2, consider restricting access to the CD command or validating the paths provided in the CD command to prevent CPU consumption. As a temporary workaround, restrict the use of the CD command with "../" sequences until a patch is available.