Sergio Alvarez

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 Description: The issue allows remote attackers to execute arbitrary JavaScript code by placing it in an image file, due to CFNetwork misinterpreting downloaded image files as local HTML documents. Recommendations: For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iPhone OS versions 1.0 through 2.1 iPhone OS for iPod touch versions 1.1 through 2.1 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory consumption and device reset, via a crafted TIFF image. **Recommendations** For Apple iPhone OS versions 1.0 through 2.1, update to a version outside of this range to resolve the issue. For iPhone OS for iPod touch versions 1.1 through 2.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider avoiding the use of crafted TIFF images until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mac OS X version 10.5.5 **Description** The issue is related to an unspecified vulnerability in Finder, which allows user-assisted attackers to cause a denial of service. This can be achieved by using a crafted Desktop file that generates an error when producing its icon, due to an error recovery issue. The result is a continuous termination and restart. **Recommendations** For Mac OS X version 10.5.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.5.5 **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash, by utilizing a crafted PICT image. This crafted image triggers an out-of-bounds read. **Recommendations** For versions prior to 7.5.5, update to version 7.5.5 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: ESET NOD32 Antivirus versions prior to 1.1743 Description: The issue is related to integer overflow in the OLE2 and CHM parsers, which can be exploited by remote attackers to execute arbitrary code. This can be achieved through crafted .DOC or .CAB files that trigger a heap-based buffer overflow. Recommendations: For versions prior to 1.1743, update to version 1.1743 or later to resolve the issue. As a temporary workaround, consider restricting access to files from untrusted sources to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: ESET NOD32 Antivirus versions prior to 1.1743 Description: The issue allows remote attackers to cause a denial of service, resulting in a crash, by utilizing a crafted .CHM file. This crafted file triggers a divide-by-zero error. Recommendations: For versions prior to 1.1743, update to version 1.1743 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** BitDefender products versions prior to 20060829 BitDefender products for Microsoft ISA Server and Exchange versions 5.5 through 2003 **Description** The issue is related to an integer overflow in the packed PE file parsing implementation, which can be exploited by remote attackers to execute arbitrary code via a crafted file. This exploitation triggers a heap-based buffer overflow. **Recommendations** For BitDefender products versions prior to 20060829, update to a version released after 20060829 to resolve the issue. For BitDefender products for Microsoft ISA Server and Exchange versions 5.5 through 2003, update to a version released after the affected range to resolve the issue. As a temporary workaround, consider restricting access to the packed PE file parsing implementation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Grisoft AVG Anti-Virus versions prior to 7.1.407 **Description** The issue involves an uninitialized variable and a crafted CAB file, allowing for remote attack vectors. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 7.1.407, update to version 7.1.407 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Grisoft AVG Anti-Virus versions prior to 7.1.407 **Description** The issue is related to "Integer Issues" and the parsing of .EXE files, allowing for remote attack vectors. The exact impact of this issue is not specified. **Recommendations** For versions prior to 7.1.407, update to version 7.1.407 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** AVG Anti-Virus versions prior to 7.1.407 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a crafted DOC file. This crafted file triggers a divide-by-zero error. **Recommendations** For versions prior to 7.1.407, update to version 7.1.407 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Grisoft AVG Anti-Virus versions prior to 7.1.407 **Description** The issue is related to multiple integer overflows that can be triggered by crafted archives, specifically CAB or RAR archives, leading to a heap-based buffer overflow. This can allow remote attackers to execute arbitrary code. **Recommendations** For versions prior to 7.1.407, update to version 7.1.407 or later to resolve the issue. As a temporary workaround, consider avoiding the use of CAB or RAR archives until the update is applied. Restrict access to the archive handling module to minimize the risk of exploitation.