Nephi Johnson

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 6 through 8 **Description** A use-after-free issue in the CSS parser allows remote attackers to execute arbitrary code or cause a denial of service via a self-referential @import rule in a stylesheet. This vulnerability can be exploited by constructing a specially crafted Web page, potentially allowing an attacker to gain the same user rights as the logged-on user. If the user has administrative rights, the attacker could take complete control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Internet Explorer versions 6 through 8, consider disabling the CSS parser or restricting the use of self-referential @import rules in stylesheets as a temporary workaround until a patch is available. Restrict access to specially crafted Web pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 1.2.0 through 1.2.12 Wireshark versions 1.4.0 through 1.4.1 **Description** The issue is related to a heap-based buffer overflow in the `dissect ldss transfer` function in the LDSS dissector. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an LDSS packet with a long digest line that triggers memory corruption. **Recommendations** For Wireshark versions 1.2.0 through 1.2.12, update to a version outside of this range to mitigate the risk. For Wireshark versions 1.4.0 through 1.4.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider disabling the `dissect ldss transfer` function until a patch is available.