Yonghui Han

**Nome do software vulnerável e versões afetadas** Versões do Open Design Alliance Drawings SDK anteriores à 2023.3 **Descrição** Existe um problema ao ler um arquivo DWG com um número de vértice inválido no modo de recuperação, levando a uma leitura fora dos limites. Isso pode permitir que um invasor execute código no contexto do processo atual ou cause uma negação de serviço. **Recomendações** Para versões anteriores à 2023.3, atualize para a versão 2023.3 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o processamento de arquivos DWG com números de vértices inválidos no modo de recuperação até que um patch esteja disponível.

**Nome do software vulnerável e versões afetadas** Versões do Open Design Alliance Drawings SDK anteriores à 2023.3 **Descrição** Existe uma falha no modo de recuperação do Drawings SDK ao ler arquivos DWG, permitindo uma leitura fora dos limites (Out-of-Bounds Read). Isso pode ser explorado por um invasor para executar código no contexto do processo atual. A vulnerabilidade está relacionada a um estouro de buffer na memória durante o processamento de arquivos DWG, o que pode levar à execução de código arbitrário ou à negação de serviço. **Recomendações** Para versões anteriores à 2023.3, atualize para a versão 2023.3 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o uso do modo de recuperação ao ler arquivos DWG para minimizar o risco de exploração. Evite usar o Drawings SDK para processar arquivos DWG não confiáveis até que o problema seja resolvido.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook versions prior to the fixed version Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified) **Description** The issue is related to errors in the mechanisms for handling objects in memory. Exploitation of this issue may allow an attacker to execute arbitrary code with the privileges of the current user using specially crafted content. To exploit the issue, a user must open a specially crafted file with an affected version of Microsoft Outlook software. The Preview Pane is not an attack vector for this issue. **Recommendations** For Microsoft Outlook, update to a version that includes the fix for this issue. For Office 365 ProPlus, apply the recommended configuration changes to minimize the risk of exploitation. For Microsoft Office, consider restricting access to specially crafted files until a patch is available. As a temporary workaround, consider disabling the handling of specially crafted files in Microsoft Outlook until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook (affected versions not specified) **Description** The issue is related to a remote code execution problem in Microsoft Outlook, caused by an out-of-bounds memory operation. This can be exploited by a remote attacker using a specially crafted file, allowing them to execute arbitrary code in the context of the current user. To exploit this issue, a user must open the specially crafted file with an affected version of Microsoft Outlook. The Preview Pane is not a viable attack vector for this problem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook (affected versions not specified) **Description** The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code using a specially crafted file. To exploit this, a user must open the crafted file with an affected version of Microsoft Outlook. This could enable the attacker to perform actions in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook (affected versions not specified) **Description** The issue is related to a remote code execution problem in Microsoft Outlook, caused by an out-of-bounds memory operation. This can be exploited by a remote attacker using a specially crafted file, allowing them to execute arbitrary code in the context of the current user. To exploit this issue, a user must open the specially crafted file with an affected version of Microsoft Outlook. The Preview Pane is not a viable attack vector for this problem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.