Timo Warns

**Name of the Vulnerable Software and Affected Versions** LibreOffice (affected versions not specified) OpenOffice (affected versions not specified) **Description** The issue is related to LibreOffice and OpenOffice automatically opening embedded content. This can be exploited by a remote attacker to impact the integrity, confidentiality, and availability of protected information. **Recommendations** For LibreOffice, consider disabling the automatic opening of embedded content until a patch is available. For OpenOffice, restrict access to embedded content to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** hostapd versions 0.6 through 1.0 **Description** The issue concerns multiple vulnerabilities in the hostapd package of the Debian GNU/Linux operating system, which can be exploited remotely to disrupt the availability of protected information. Specifically, a heap-based buffer overflow in the `eap server tls process fragment` function in `eap server tls common.c` can cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set. **Recommendations** For hostapd versions 0.6 through 1.0, consider disabling the `eap server tls process fragment` function as a temporary workaround until a patch is available. Restrict access to the EAP authentication server to minimize the risk of exploitation. Avoid using the `eap server tls process fragment` function in the EAP-TLS message processing until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 2.1.10 through 2.1.12 **Description** The issue is related to a stack-based buffer overflow in the `cbtls verify` function when using TLS-based EAP methods. This can be triggered by a remote attacker sending a client certificate with a long "not after" timestamp, potentially causing a denial of service (server crash) and possibly allowing the execution of arbitrary code. Multiple vulnerabilities in the FreeRADIUS package may lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely. **Recommendations** For FreeRADIUS versions 2.1.10 through 2.1.12, consider updating to a version that fixes the `cbtls verify` function issue to prevent potential code execution and denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenOffice.org versions prior to 3.5.5 LibreOffice versions prior to 3.5.5 **Description** The issue is related to a buffer overflow in the XML manifest encryption tag parsing functionality. This can be exploited by a remote attacker using a crafted Open Document Text (.odt) file, potentially allowing them to execute arbitrary code, cause a denial of service, or access and modify confidential data. The exploitation can occur through various means, including a child tag within an incorrect parent tag, duplicate tags, or a Base64 ChecksumAttribute with a length not evenly divisible by four. **Recommendations** For OpenOffice.org versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue. For LibreOffice versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted Open Document Text (.odt) files and restricting access to sensitive data until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.3.5 **Description** The issue is related to multiple buffer overflows in the hfsplus filesystem implementation, allowing local users to gain privileges via a crafted HFS plus filesystem. **Recommendations** For versions prior to 3.3.5, update to version 3.3.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.1-rc3 **Description** The issue is related to the `befs follow link` function in `fs/befs/linuxvfs.c`, which does not validate the length attribute of long symlinks. This allows local users to cause a denial of service by accessing a long symlink on a malformed Be filesystem, resulting in an incorrect pointer dereference and OOPS. **Recommendations** For Linux kernel versions prior to 3.1-rc3, update to version 3.1-rc3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.38-rc6-git6 **Description** The issue is related to the ldm parse vmdb function in the Linux kernel, which does not validate the VBLK size value in the VMDB structure in an LDM partition table. This allows local users to cause a denial of service, resulting in a divide-by-zero error and OOPS, via a crafted partition table. **Recommendations** For Linux kernel versions prior to 2.6.38-rc6-git6, update to version 2.6.38-rc6-git6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.37.2 **Description** The issue is related to a buffer overflow in the `mac partition` function, located in `fs/partitions/mac.c`. This can be exploited by local users through a malformed Mac OS partition table, potentially causing a denial of service or other unspecified impacts. **Recommendations** For versions prior to 2.6.37.2, update to version 2.6.37.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 2.6.37.2 and earlier kernel-kdumppae (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the `ldm frag add` function in the Linux kernel, which might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of the SUSE Linux Enterprise operating system that can be exploited remotely, potentially leading to a disruption of protected information availability. **Recommendations** For Linux kernel version 2.6.37.2 and earlier: update to a version that contains a fix for this issue. For kernel-kdumppae: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SUSE Linux Enterprise versions prior to 2.6.39 btrfs-kmp-xen (affected versions not specified) btrfs-kmp-pae (affected versions not specified) kernel-desktop-devel (affected versions not specified) **Description** The issue concerns multiple vulnerabilities in the SUSE Linux Enterprise operating system, specifically in the btrfs-kmp-xen, btrfs-kmp-pae, and kernel-desktop-devel packages. These vulnerabilities can be exploited locally and may lead to a breach of confidentiality, integrity, and availability of protected information. A specific vulnerability in the Linux kernel before version 2.6.39 is related to the `is gpt valid` function in `fs/partitions/efi.c`, which does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry. This allows physically proximate attackers to cause a denial of service or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device. **Recommendations** For SUSE Linux Enterprise versions prior to 2.6.39, update to version 2.6.39 or later to resolve the issue. For btrfs-kmp-xen, btrfs-kmp-pae, and kernel-desktop-devel, at the moment, there is no information about a newer version that contains a fix for this vulnerability.