Tim Newsham

**Name of the Vulnerable Software and Affected Versions** OpenBSD versions 5.8 through 5.9 **Description** The issue is related to an integer truncation error in the `amap alloc` function, which can be exploited by local users to execute arbitrary code with kernel privileges. This can be achieved by providing a large size value. The error is associated with improper handling of numbers. **Recommendations** For OpenBSD versions 5.8 and 5.9, consider restricting access to the `amap alloc` function until a patch is available. As a temporary workaround, avoid using large size values in the `amap alloc` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenBSD version 5.9 **Description** The issue is caused by an integer overflow in the `uvm map isavail` function, which can be triggered by a local user via a crafted `mmap` call. This results in a denial of service, specifically a kernel panic, when the new mapping overlaps with an existing mapping. **Recommendations** For OpenBSD version 5.9, consider applying configuration changes to restrict the use of the `mmap` system call to minimize the risk of exploitation. As a temporary workaround, restrict access to the `uvm map isavail` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** H2O versions 1.7.3 and earlier H2O versions 2.x before 2.0.0-beta5 **Description** The issue is related to the mishandling of HTTP/2 disconnection in the `lib/http2/connection.c` file. This allows remote attackers to cause a denial of service, resulting in a use-after-free condition and application crash, or possibly execute arbitrary code via a crafted packet. **Recommendations** For H2O versions 1.7.3 and earlier, update to version 1.7.3 or later. For H2O versions 2.x before 2.0.0-beta5, update to version 2.0.0-beta5 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSSH (affected versions not specified) **Description** The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.