Fady Othman

**Name of the Vulnerable Software and Affected Versions** NSF Unidata NetCDF-C (affected versions not specified) **Description** A flaw exists in the parsing of dimension names within NSF Unidata NetCDF-C, leading to a heap-based buffer overflow. This allows remote attackers to execute arbitrary code on affected systems. User interaction is required, specifically the target must visit a malicious page or open a malicious file. The issue stems from insufficient validation of the length of user-supplied data before copying it into a fixed-length heap-based buffer. An attacker can exploit this to execute code with the privileges of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Vesta Control Panel versions through 0.9.8-27 myVesta versions through 0.9.8-26-39 Description: The issue allows uploads from a different origin due to a problem in the web/upload/UploadHandler.php file. Recommendations: For Vesta Control Panel versions through 0.9.8-27, update to a version that fixes the issue in the web/upload/UploadHandler.php file. For myVesta versions through 0.9.8-26-39, update to a version that fixes the issue in the web/upload/UploadHandler.php file.

**Name of the Vulnerable Software and Affected Versions** Clam AntiVirus (ClamAV) version 0.102.2 **Description** A vulnerability in the ARJ archive parsing module could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The issue is due to a heap buffer overflow read. An attacker could exploit this by sending a crafted ARJ file to an affected device, potentially causing the ClamAV scanning process to crash. **Recommendations** For version 0.102.2, consider updating to a newer version that addresses the heap buffer overflow read issue in the ARJ archive parsing module to prevent denial of service conditions. As a temporary workaround, consider restricting the processing of ARJ files until a patch is available.