Ao Wang

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** The `ptrace(PT SC REMOTE)` function failed to properly validate parameters for the `syscall(2)` and ` syscall(2)` meta-system calls. This allows a user with debugging capabilities to trigger arbitrary code execution in the kernel, regardless of the target process's privileges. An unprivileged local user can exploit this to escalate privileges and potentially gain full control of the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Solaris version 11 **Description** An easily exploitable issue exists in the Kernel component of Oracle Solaris that allows an unauthenticated attacker with network access via TCP to compromise the system. Successful attacks can result in unauthorized read access to a subset of Oracle Solaris data. **Recommendations** Update to a newer version that addresses this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions 7.1.14 and 7.2.4 **Description** A difficult to exploit issue exists in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). An unauthenticated attacker with access to the physical communication segment attached to the hardware where Oracle VM VirtualBox executes can compromise the software. Successful attacks can result in a takeover of Oracle VM VirtualBox. **Recommendations** Update Oracle VM VirtualBox to a version later than 7.1.14. Update Oracle VM VirtualBox to a version later than 7.2.4.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions 12.4-RELEASE through 12.4-RELEASE-p8 FreeBSD versions 13.2-RELEASE through 13.2-RELEASE-p6 FreeBSD versions 14.0-RELEASE through 14.0-RELEASE-p1 **Description** The pf(4) packet filter in FreeBSD incorrectly validates TCP sequence numbers, which could allow a malicious actor to execute a denial-of-service attack against hosts behind the firewall. This issue is related to improper access control in the packet filter component. **Recommendations** For FreeBSD versions 12.4-RELEASE through 12.4-RELEASE-p8, update to 12.4-RELEASE-p9 or later. For FreeBSD versions 13.2-RELEASE through 13.2-RELEASE-p6, update to 13.2-RELEASE-p7 or later. For FreeBSD versions 14.0-RELEASE through 14.0-RELEASE-p1, update to 14.0-RELEASE-p2 or later. As a temporary workaround, consider restricting access to the pf(4) packet filter until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 **Description** An elevation of privilege issue in libzipfile could allow a local malicious application to execute arbitrary code within the context of a privileged process, potentially leading to a local permanent device compromise. This compromise may require reflashing the operating system to repair the device. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later.