Gabriel Campana

**Name of the Vulnerable Software and Affected Versions** Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products (affected versions not specified) **Description** The issue is related to improper input validation, which may allow a privileged user to potentially enable escalation of privilege via local access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Reminder versions prior to 12.3.01.3000 Reminder versions prior to 12.2.05.6000 Reminder versions prior to 11.6.08.6000 **Description** The issue is related to improper access control in the Reminder application, allowing attackers to register reminders or execute exported activities remotely. This could potentially affect a large number of devices worldwide, although the exact number is not specified. **Recommendations** For versions prior to 12.3.01.3000, update to version 12.3.01.3000 or later. For versions prior to 12.2.05.6000, update to version 12.2.05.6000 or later. For versions prior to 11.6.08.6000, update to version 11.6.08.6000 or later.

**Name of the Vulnerable Software and Affected Versions** Flatpak versions prior to 0.8.9 Flatpak versions 0.9.x Flatpak versions 0.10.x prior to 0.10.3 **Description** The issue allows crafted D-Bus messages to the host to be used to break out of the sandbox. This is due to differences in whitespace handling between the proxy and the daemon. **Recommendations** For versions prior to 0.8.9, update to version 0.8.9 or later. For versions 0.9.x, update to version 0.10.3 or later. For versions 0.10.x prior to 0.10.3, update to version 0.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to a memory leak that can be triggered when specific options such as `--add-mac`, `--add-cpe-id`, or `--add-subnet` are used. This allows remote attackers to cause a denial of service by consuming memory through vectors involving DNS response creation. **Recommendations** For dnsmasq versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the `--add-mac`, `--add-cpe-id`, and `--add-subnet` options until the update is applied.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is caused by an integer underflow in the `add pseudoheader` function of the Dnsmasq DNS server when the `--add-mac`, `--add-cpe-id`, or `--add-subnet` option is specified. This allows a remote attacker to cause a denial of service via a specially crafted DNS request. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider disabling the `add pseudoheader` function or avoiding the use of the `--add-mac`, `--add-cpe-id`, or `--add-subnet` options until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is a heap-based buffer overflow that can be triggered by a crafted DNS response, allowing remote attackers to cause a denial of service or execute arbitrary code. This can occur due to a missing bounds check in the `do rfc1035 name` function of `util.c`, potentially leading to an out of bounds write. The exploitation of this issue does not require user interaction and can result in remote code execution, denial of service, or an out of memory situation. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting DNS response processing to minimize the risk of exploitation. Avoid using the `do rfc1035 name` function in `util.c` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is caused by a stack-based buffer overflow in the DNS server. It can be exploited by a remote attacker using a specially crafted DHCPv6 request, potentially leading to a denial of service or the execution of arbitrary code. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dnsmasq versions prior to 2.78 **Description** The issue is caused by a heap-based buffer overflow in the dynamic memory of the DNS server. This can be exploited by a remote attacker using a specially crafted IPv6 request, potentially allowing them to cause a denial of service or execute arbitrary code. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to deficiencies in handling forwarded DHCPv6 requests, which can be exploited by a remote attacker to disclose sensitive information by injecting special elements into a command. This can allow remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 relay functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Irssi versions prior to 0.8.20 **Description** The issue allows remote attackers to cause a denial of service, resulting in heap corruption and a crash, through vectors involving the length of a string. This is due to a problem in the format send to gui function in the format parsing code. **Recommendations** For versions prior to 0.8.20, update to version 0.8.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the format send to gui function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Irssi versions prior to 0.8.20 **Description** The issue allows remote attackers to cause a denial of service, resulting in heap corruption and crash, via an incomplete 24bit color code. This occurs in the unformat 24bit color function within the format parsing code when Irssi is compiled with true-color enabled. **Recommendations** For versions prior to 0.8.20, update to version 0.8.20 or later to resolve the issue. As a temporary workaround, consider disabling true-color support until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apport versions prior to 2.19.2 **Description** The issue concerns Apport, where any Python module in sys.path can be imported under specific conditions. This occurs when the command line of the process triggering the coredump is Python and the first argument is -m. The function python module path is involved in this issue. **Recommendations** For versions prior to 2.19.2, update to version 2.19.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Cisco Secure ACS versions 3.x through 3.3(4) Build 12 patch 6 Cisco Secure ACS versions 4.0.x Cisco Secure ACS versions 4.1.x through 4.1(4) Build 13 Patch 10 Cisco Secure ACS versions 4.2.x through 4.2(0) Build 123 Patch 3 Description: The issue arises from improper handling of an EAP Response packet where the length field value exceeds the actual packet length. This can be exploited by remote authenticated users to cause a denial of service, leading to the crash of the CSRadius and CSAuth services, or potentially execute arbitrary code. The exploitation can occur through crafted RADIUS packets, specifically EAP-Response/Identity, EAP-Response/MD5, or EAP-Response/TLS Message Attribute packets. Recommendations: For Cisco Secure ACS versions 3.x through 3.3(4) Build 12 patch 6, update to version 3.3(4) Build 12 patch 7 or later. For Cisco Secure ACS versions 4.0.x, update to a version outside of the 4.0.x range, as no specific fix is mentioned within this range. For Cisco Secure ACS versions 4.1.x through 4.1(4) Build 13 Patch 10, update to version 4.1(4) Build 13 Patch 11 or later. For Cisco Secure ACS versions 4.2.x through 4.2(0) Build 123 Patch 3, update to version 4.2(0) Build 124 Patch 4 or later.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.25.9 **Description** The issue is related to an integer overflow in the `sctp getsockopt local addrs old` function, which is part of the Stream Control Transmission Protocol (sctp) functionality. This overflow can be triggered by local users through vectors involving a large `addr num` field in an `sctp getaddrs old` data structure, leading to a denial of service (resource consumption and system outage). **Recommendations** For Linux kernel versions prior to 2.6.25.9, update to version 2.6.25.9 or later to resolve the issue.