Debasish Mandal

**Name of the Vulnerable Software and Affected Versions** Microsoft Office 2016 Microsoft Word 2016 in Microsoft Office 2016 **Description** The issue is related to the improper handling of objects in memory, which can allow a remote attacker to execute arbitrary code by using a specially crafted file. If the current user is logged on with administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights. **Recommendations** For Microsoft Office 2016, consider avoiding the use of specially crafted files until a patch is available. For Microsoft Word 2016 in Microsoft Office 2016, as a temporary workaround, consider restricting the opening of files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VLC media player versions 2.0.5 and earlier **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read. When parsing a specially crafted ASF movie, a buffer overflow might occur, leading to a crash of VLC media player's process. In some cases, attackers might exploit this issue to execute arbitrary code within the context of the application. **Recommendations** For versions 2.0.5 and earlier, update to a version later than 2.0.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the ASF Demuxer module until a patch is available. Restrict access to crafted ASF movies to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GOM Player version 2.1.33.5071 **Description** A stack-based buffer overflow issue allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the `ref href` tag. This issue exists due to a regression. **Recommendations** For GOM Player version 2.1.33.5071, at the moment, there is no information about a newer version that contains a fix for this issue.