David Remahl

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.19 Mozilla Firefox versions 3.6.x prior to 3.6.17 SeaMonkey versions prior to 2.0.14 **Description** The issue allows remote attackers to bypass intended access restrictions via unknown vectors. This is related to an unspecified vulnerability in the Java Embedding Plugin (JEP) on Mac OS X. **Recommendations** For Mozilla Firefox versions prior to 3.5.19, update to version 3.5.19 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.17, update to version 3.6.17 or later. For SeaMonkey versions prior to 2.0.14, update to version 2.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions 1.3.0 through 1.6.10 MediaWiki versions 1.12.x before 1.12.2 MediaWiki versions 1.13.x before 1.13.3 **Description** A cross-site request forgery (CSRF) issue in the Special:Import feature allows remote attackers to perform unspecified actions as authenticated users via unknown vectors. **Recommendations** For MediaWiki versions 1.3.0 through 1.6.10, update to a version outside of this range to resolve the issue. For MediaWiki versions 1.12.x before 1.12.2, update to version 1.12.2 or later. For MediaWiki versions 1.13.x before 1.13.3, update to version 1.13.3 or later.

Name of the Vulnerable Software and Affected Versions: Python versions prior to 2.5.2 Description: The issue is related to an integer overflow in the hashlib module, specifically in the hashopenssl.c file. This could potentially allow attackers to defeat cryptographic digests in certain contexts, particularly when dealing with data that exceeds 4GB. Recommendations: For versions prior to 2.5.2, update to a version that includes the fix for the integer overflow in the hashlib module to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** Python versions prior to 2.5.3 **Description** The issue is caused by multiple integer overflows in imageop.c, which can be exploited by context-dependent attackers using crafted images to trigger heap-based buffer overflows. This could lead to a denial of service (crash) and possibly the execution of arbitrary code. **Recommendations** For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted images to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mac OS X version 10.3.9 **Description** A buffer overflow issue in CoreFoundation allows attackers to execute arbitrary code via command line arguments to an application that uses CoreFoundation. **Recommendations** For Mac OS X version 10.3.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CoreFoundation versions 10.3.9 through 10.4.2 **Description** The issue allows attackers to cause a denial of service, specifically CPU consumption, by utilizing crafted Gregorian dates. **Recommendations** For versions 10.3.9 through 10.4.2, update to a version that contains a fix for this issue to prevent denial of service attacks.

Name of the Vulnerable Software and Affected Versions: Apple Keynote versions 2.0 through 2.0.1 Description: The issue allows remote attackers to read arbitrary files via the keynote: URI handler in a crafted Keynote presentation. Recommendations: For Apple Keynote versions 2.0 through 2.0.1, consider disabling the keynote: URI handler until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime Player version 7.0 on Mac OS X 10.4 **Description** The issue allows remote attackers to obtain sensitive information via a .mov file with a Quartz Composer composition (.qtz) file. This is possible because compositions created with an advanced set of tools, called patches, can be embedded within the file to trigger the issue. By combining patches that provide advanced system information with patches that load information from the Internet, it is possible for a remote attacker to create a malicious *.qtz or *.mov file. This file would disclose sensitive information to a malicious server once the victim views the file, for example, in a web browser with the QuickTime plugin. **Recommendations** For Apple QuickTime Player version 7.0 on Mac OS X 10.4, consider disabling the use of Quartz Composer files (*.qtz) as a temporary workaround until a patch is available. Restrict access to compositions created with the Quartz Composer application to minimize the risk of exploitation. Avoid viewing suspicious .mov files, especially those containing Quartz Composer compositions, in a web browser with the QuickTime plugin.

Name of the Vulnerable Software and Affected Versions: Apple Terminal version 1.4.4 Description: The issue concerns the x-man-page: URI handler in Apple Terminal, which fails to properly cleanse terminal escape sequences. This allows remote attackers to execute arbitrary commands. Recommendations: For Apple Terminal version 1.4.4, consider disabling the x-man-page: URI handler as a temporary workaround until a patch is available.

Name of the Vulnerable Software and Affected Versions: Apple Terminal version 1.4.4 Description: The issue allows attackers to execute arbitrary commands via terminal escape sequences. Recommendations: For Apple Terminal version 1.4.4, update to a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Apple Help Viewer versions 2.0.7 and 3.0.0 in Mac OS X 10.3.9 Description: The issue allows remote attackers to read and execute arbitrary scripts with less restrictive privileges via a help:// URI. Recommendations: For Apple Help Viewer version 2.0.7, consider disabling the handling of help:// URIs until a patch is available. For Apple Help Viewer version 3.0.0, restrict access to the help:// URI scheme to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mac OS X version 10.3.9 Description: The issue concerns the AppleScript Editor in Mac OS X, which fails to properly display script code for an applescript: URI. This can lead to a discrepancy between the displayed code and the actual code that would be executed, potentially allowing remote attackers to deceive users into running malicious code. This can be achieved through the use of certain URI characters, including NULL, control characters, and homographs. Recommendations: For Mac OS X version 10.3.9, consider avoiding the use of the AppleScript Editor for executing scripts from untrusted sources until a fix is available. As a temporary workaround, restrict the handling of applescript: URIs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AppleWebKit (WebCore and WebKit) versions used in Safari 1.2 and OmniGroup OmniWeb 5.1 **Description** The issue allows remote attackers to read arbitrary files via the XMLHttpRequest Javascript component. This can be achieved by using automatically mounted disk images and file:// URLs. **Recommendations** For AppleWebKit (WebCore and WebKit) versions used in Safari 1.2 and OmniGroup OmniWeb 5.1, consider disabling the XMLHttpRequest Javascript component as a temporary workaround until a patch is available. Restrict access to file:// URLs to minimize the risk of exploitation.