Robert Zacek

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview **Description** The Authenticode Signature Verification function in Microsoft Windows does not properly validate the digest of a signed portable executable (PE) file. This allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content. An attacker could exploit the vulnerability by modifying an existing signed executable file to add malicious code without invalidating the signature, potentially taking complete control of an affected system. **Recommendations** For Microsoft Windows XP SP2 and SP3, consider applying security updates or patches to fix the Authenticode Signature Verification issue. For Windows Server 2003 SP2, apply the recommended security patch to resolve the vulnerability. For Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview, update to a newer version or apply the relevant security fix to mitigate the risk of exploitation. As a temporary workaround, consider restricting the execution of signed portable executable (PE) files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Encode module versions prior to 2.44 Perl versions prior to 5.15.6 **Description** The issue is related to an off-by-one error in the decode xs function, which can lead to a denial of service due to memory corruption. This is caused by a heap-based buffer overflow when processing a crafted Unicode string. The vulnerability is associated with errors in number processing and can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Encode module versions prior to 2.44, update to version 2.44 or later. For Perl versions prior to 5.15.6, update to version 5.15.6 or later.