Emmanouel Kellinis

**Name of the Vulnerable Software and Affected Versions** Ruby versions 1.9.1 before 1.9.1-p376 **Description** The issue is a heap-based buffer overflow in the `rb str justify` function, allowing context-dependent attackers to execute arbitrary code. This can be achieved via unspecified vectors involving the `String#ljust`, `String#center`, or `String#rjust` functions. **Recommendations** For Ruby versions 1.9.1 before 1.9.1-p376, update to version 1.9.1-p376 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `String#ljust`, `String#center`, and `String#rjust` functions until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Android versions 1.5 and earlier **Description** The issue is related to an unspecified function in the Dalvik API, allowing remote attackers to cause a denial of service, which results in a system process restart, via a crafted application. **Recommendations** For Android versions 1.5 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware ACE versions 2.5.1 and earlier **Description** The issue concerns an unspecified vulnerability in the ACE shared folders implementation within the VMware Host Guest File System (HGFS) shared folders feature. This vulnerability allows attackers to enable a disabled shared folder. **Recommendations** For versions 2.5.1 and earlier, consider disabling the HGFS shared folders feature until a patch is available. Restrict access to shared folders to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Asterisk versions 1.2.6 and earlier **Description** The issue is caused by an integer signedness error in the format jpeg.c file, which allows remote attackers to execute arbitrary code. This is achieved by providing a length value that passes a length check as a negative number but triggers a buffer overflow when used as an unsigned length. **Recommendations** For Asterisk versions 1.2.6 and earlier, update to a version later than 1.2.6 to resolve the issue.