Alberto Garcia

**Name of the Vulnerable Software and Affected Versions** Apache Xerces-C XML Parser library versions prior to 3.2.1 **Description** The issue is related to the incorrect processing of external DTD paths in the Apache Xerces-C XML Parser library, which can lead to a null pointer dereference under certain conditions. This can potentially allow a remote attacker to cause a denial of service. **Recommendations** For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of external DTD paths until a patch is available.

**Name of the Vulnerable Software and Affected Versions** openssl versions prior to 5.0.0a-2.2 in Debian wheezy openssl versions prior to 5.0.0a-2.3+deb8u1 in Debian jessie openssl versions prior to 5.0.0a-3 in Debian unstable **Description** The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file. **Recommendations** For Debian wheezy, update to version 5.0.0a-2.2 or later. For Debian jessie, update to version 5.0.0a-2.3+deb8u1 or later. For Debian unstable, update to version 5.0.0a-3 or later.

**Name of the Vulnerable Software and Affected Versions** Poppler versions prior to 0.56 **Description** The issue is related to a stack buffer overflow in GfxState.cc in pdftocairo, which can be triggered by a crafted PDF document, leading to a denial of service (application crash). **Recommendations** For versions prior to 0.56, update to version 0.56 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Poppler versions prior to 0.56 **Description** The issue is related to an integer overflow that leads to a heap buffer overflow in the JBIG2Stream.cc file within the pdftocairo component of Poppler. This can be triggered by remote attackers using a crafted PDF document, potentially causing a denial of service (application crash) or other unspecified impacts. **Recommendations** For versions prior to 0.56, update to version 0.56 or later to resolve the issue. As a temporary workaround, consider restricting the handling of PDF documents from untrusted sources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** CVS versions 1.12 and earlier **Description** The issue allows remote attackers to bypass authentication via the pserver access method when using the repouid patch on Debian GNU/Linux. **Recommendations** For CVS versions 1.12 and earlier, consider disabling the pserver access method until a patch is available. Restrict access to the repouid patch to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: CVS versions 1.12 and earlier Description: The issue arises when CVS does not properly handle the absence of a mapping for the current repository in the cvs-repouids file. This can be exploited by remote attackers to cause a denial of service, resulting in a server crash. Recommendations: For CVS versions 1.12 and earlier, ensure proper configuration and handling of repository mappings in the cvs-repouids file to prevent server crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.