Anders Kaseorg

**Name of the Vulnerable Software and Affected Versions** sudo versions 1.3.1 through 1.6.9p22 sudo versions 1.7.0 through 1.7.2p6 **Description** The issue is related to the secure path feature in sudo, which does not properly handle an environment containing multiple PATH variables. This could allow local users to gain privileges via a crafted value of the last PATH variable. Multiple vulnerabilities in the sudo package may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker. **Recommendations** For sudo versions 1.3.1 through 1.6.9p22, update to a version newer than 1.6.9p22 to resolve the issue. For sudo versions 1.7.0 through 1.7.2p6, update to a version newer than 1.7.2p6 to resolve the issue. As a temporary workaround, consider restricting access to the sudo functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** BarnOwl versions prior to 1.0.5 owl version 2.1.11 **Description** The issue involves multiple buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved through various vectors, including a crafted zcrypt message related to zcrypt.c, and a reply command on a message with a Zephyr Cc: list, related to zwrite.c. **Recommendations** For BarnOwl versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. For owl version 2.1.11, update to a version later than 2.1.11 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ndiswrapper versions prior to 1.53-r1 **Description** The issue affects the ndiswrapper package in Gentoo Linux and the Linux kernel 2.6, allowing remote attackers to execute arbitrary code by sending packets over a local wireless network with long ESSIDs, potentially compromising confidentiality, integrity, and availability of protected information. **Recommendations** For ndiswrapper versions prior to 1.53-r1, update to version 1.53-r1 or later to resolve the issue. As a temporary workaround, consider restricting access to wireless networks to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** afuse version 0.2 **Description** The issue concerns multiple vulnerabilities in the afuse package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. Specifically, the expand template function in afuse.c is vulnerable to shell metacharacters in a pathname, allowing local users to gain privileges. **Recommendations** For afuse version 0.2, consider restricting access to the expand template function in afuse.c to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using pathnames with shell metacharacters in the affected function.