Pengsu Cheng

**Nome do software vulnerável e versões afetadas** Foxit Studio Photo versão 3.6.6.922 **Descrição** Esta vulnerabilidade permite que invasores remotos executem código arbitrário nas instalações afetadas. É necessária a interação do usuário, que deve visitar uma página maliciosa ou abrir um arquivo malicioso. A falha existe no tratamento de arquivos PSD devido à falta de validação adequada dos dados fornecidos pelo usuário, resultando em uma gravação além do fim de uma estrutura alocada. Um invasor pode aproveitar isso para executar código no contexto do processo atual. **Recomendações** Para o Foxit Studio Photo versão 3.6.6.922, no momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat versions prior to 2019.010.20101 Adobe Acrobat Reader versions prior to 2019.010.20101 Adobe Acrobat 2019 versions prior to 2019.010.20101 Adobe Acrobat Reader 2019 versions prior to 2019.010.20101 Adobe Acrobat 2017 versions prior to 2017.011.30141 Adobe Acrobat Reader 2017 versions prior to 2017.011.30141 Adobe Acrobat 2015 versions prior to 2015.006.30496 Adobe Acrobat Reader 2015 versions prior to 2015.006.30496 **Description** The issue is related to an out-of-bounds read operation in memory, which can be exploited by a remote attacker to gain unauthorized access to protected information. This can lead to information disclosure. **Recommendations** For Adobe Acrobat and Reader 2019, update to version 2019.010.20101 or later. For Adobe Acrobat and Reader 2017, update to version 2017.011.30141 or later. For Adobe Acrobat and Reader 2015, update to version 2015.006.30496 or later. As a temporary workaround, consider restricting access to sensitive information until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers **Description** The issue is related to an information disclosure vulnerability in the Windows GDI component, which improperly discloses the contents of its memory. This can be exploited by attackers to obtain sensitive information using a specially crafted document. The vulnerability is associated with errors in the mechanisms for handling objects in memory. **Recommendations** For Windows 7, consider applying security updates to address the issue. For Windows Server 2012 R2, apply the latest security patches. For Windows RT 8.1, install the latest available updates. For Windows Server 2008, ensure all security updates are applied. For Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers, apply the relevant security updates to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2018.011.20040 and earlier Adobe Acrobat and Reader versions 2017.011.30080 and earlier Adobe Acrobat and Reader versions 2015.006.30418 and earlier **Description** The issue is an out-of-bounds read that could lead to information disclosure. Successful exploitation allows attackers to obtain sensitive information. **Recommendations** For Adobe Acrobat and Reader versions 2018.011.20040 and earlier, update to a version later than 2018.011.20040 to resolve the issue. For Adobe Acrobat and Reader versions 2017.011.30080 and earlier, update to a version later than 2017.011.30080 to resolve the issue. For Adobe Acrobat and Reader versions 2015.006.30418 and earlier, update to a version later than 2015.006.30418 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft JET Database Engine versions prior to the fixed version **Description** A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. This issue can be exploited by using a specially crafted Excel file, potentially allowing an attacker to execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For versions prior to the fixed version, apply the patch provided by Microsoft to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 Description: A cross-site scripting (XSS) issue exists due to the improper escaping of HTML attributes, allowing user-assisted remote attackers to inject arbitrary web script or HTML and read local files. Recommendations: For versions prior to 4.0, update to version 4.0 or later to resolve the issue.