Andrei Nigmatulin

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.2.6 **Description** A stack-based buffer overflow issue exists in the FastCGI SAPI (fastcgi.c) of PHP, with unknown impact and attack vectors. **Recommendations** For versions prior to 5.2.6, update to version 5.2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved by using a TIFF image with an invalid tag. **Recommendations** For versions prior to 6.0, update to version 6.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, by utilizing a crafted TIFF file. **Recommendations** For versions prior to 6.0, update to version 6.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.0 **Description** A heap-based buffer overflow issue exists in the SGI parser, allowing remote attackers to execute arbitrary code via a crafted SGI image file. **Recommendations** For versions prior to 6.0, update to version 6.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions 6.1.0 through 6.1.7 **Description** A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a .PSD image file with a large number of layers. **Recommendations** For versions 6.1.0 through 6.1.7, update to a version that contains a fix for this issue to prevent exploitation.

Name of the Vulnerable Software and Affected Versions: libtiff versions 3.6.1 and earlier Description: The issue is related to a heap-based buffer overflow in the OJPEGVSetField function, which can be exploited by remote attackers to execute arbitrary code. This is possible through a malformed TIFF image. Recommendations: For libtiff versions 3.6.1 and earlier, consider disabling the OJPEG SUPPORT option as a temporary workaround until a patch is available.