Gabriel Corona

**Name of the Vulnerable Software and Affected Versions** Emacs versions 28.1 through 28.2 **Description** The issue is related to a lack of compliance with the Desktop Entry Specification, allowing shell command injections through a crafted mailto: URI. This affects emacsclient-mail.desktop. **Recommendations** For versions 28.1 through 28.2, update to version 29.0.90 to resolve the issue. As a temporary workaround, consider restricting the use of mailto: URIs in emacsclient-mail.desktop until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Emacs versions 28.1 through 28.2 **Description** The issue allows for Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. **Recommendations** For versions 28.1 through 28.2, update to version 29.0.90 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mono versions prior to 6.8.0.105+dfsg-3.3 **Description** The issue allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with an un-sandboxed Mono CLR interpreter. **Recommendations** For versions prior to 6.8.0.105+dfsg-3.3, update to version 6.8.0.105+dfsg-3.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue concerns improved Host header checks. These checks are designed to reject requests that are not sent to a well-known local hostname or IP, or the server-specified hostname. This is a measure to enhance security by ensuring that requests are legitimate and targeted at the correct host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Selenium Selenium Grid (formerly Selenium Standalone Server) versions prior to 4.0.0-alpha-7 **Description** The issue is related to DNS rebinding, which can be used to execute arbitrary code on the machine. The component affected is the WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is triggered by browsing to a malicious remote web server. This allows for the execution of arbitrary code remotely. **Recommendations** For versions prior to 4.0.0-alpha-7, update to version 4.0.0-alpha-7 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebDriver endpoint of Selenium Server (Grid) to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OWASP Zed Attack Proxy versions through w2022-03-21 **Description** The issue is related to incorrect authentication of a certificate in the web application security scanner. It may allow a remote attacker to compromise the integrity of protected information. The problem lies in the failure to verify the TLS certificate chain of an HTTPS server. **Recommendations** For OWASP Zed Attack Proxy versions through w2022-03-21, update to a version that verifies the TLS certificate chain of an HTTPS server to prevent exploitation. As a temporary workaround, consider restricting the use of the scanner until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ReadyMedia (formerly MiniDLNA) versions prior to 1.3.1 **Description** A DNS rebinding issue allows a remote web server to exfiltrate media files. **Recommendations** For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** geckodriver versions prior to 0.27.0 **Description** The issue is related to missing checks on Content-Type headers in geckodriver, which could lead to a CSRF vulnerability. This vulnerability might allow remote code execution when paired with a specifically prepared request. **Recommendations** For geckodriver versions prior to 0.27.0, update to version 0.27.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the geckodriver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** npupnp versions prior to 4.1.4 **Description** The issue affects the embedded web server in npupnp, including UPnP SOAP and GENA endpoints, due to DNS rebinding. This can lead to remote code execution. **Recommendations** For versions prior to 4.1.4, update to version 4.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the embedded web server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 83 Firefox ESR versions prior to 78.5 Thunderbird versions prior to 78.5 **Description** The issue arises when DNS over HTTPS is in use, and it fails to filter out RFC1918 and related IP ranges from responses when an IPv4 address is mapped through IPv6. This oversight can lead to a potential DNS Rebinding attack. **Recommendations** For Firefox versions prior to 83, update to version 83 or later to resolve the issue. For Firefox ESR versions prior to 78.5, update to version 78.5 or later to resolve the issue. For Thunderbird versions prior to 78.5, update to version 78.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Freebox Server versions prior to 4.2.3 **Description** A DNS rebinding issue exists in the UPnP MediaServer implementation. **Recommendations** For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Freebox Server versions prior to 4.2.3 **Description** A DNS rebinding issue affects the Freebox OS web interface. This could potentially allow for malicious actions. **Recommendations** For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Freebox versions prior to 1.5.29 Freebox Server versions prior to 4.2.3 **Description** A DNS rebinding issue affects the UPnP IGD implementations. **Recommendations** For Freebox versions prior to 1.5.29, update to version 1.5.29 or later. For Freebox Server versions prior to 4.2.3, update to version 4.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Freebox version 1.5.28 and earlier **Description** A DNS rebinding issue affects the software, potentially allowing unauthorized access. **Recommendations** For versions prior to 1.5.29, update to version 1.5.29 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Freebox Server versions prior to 4.2.3 **Description** A CSRF issue exists in the UPnP MediaServer implementation. **Recommendations** For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LilyPond version 2.19.80 **Description** The issue allows remote attackers to conduct argument-injection attacks via a crafted URL. This is because the `lilypond-invoke-editor` in LilyPond does not validate strings before launching the program specified by the `BROWSER` environment variable. The GNU Guile code uses the `system` Scheme procedure instead of the `system*` Scheme procedure, which leads to this problem. **Recommendations** For LilyPond version 2.19.80, consider validating strings before launching the program specified by the `BROWSER` environment variable to prevent argument-injection attacks. As a temporary workaround, restrict the use of the `BROWSER` environment variable until a patch is available.

Name of the Vulnerable Software and Affected Versions: xdg-utils versions prior to 1.1.3 Description: The issue is related to the `open envvar` function in `xdg-open`, which does not properly validate strings before launching the program specified by the `BROWSER` environment variable. This could allow remote attackers to conduct argument-injection attacks via a crafted URL. For example, using `%s` in the `BROWSER` environment variable could lead to such an attack. The vulnerability might also allow a remote attacker to gain unauthorized access to information and disrupt its integrity and availability. Recommendations: For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider validating the strings passed to the `open envvar` function or restricting the use of the `BROWSER` environment variable to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** sensible-utils versions prior to 0.0.11 **Description** The issue allows remote attackers to conduct argument-injection attacks via a crafted URL. This is possible because the sensible-browser in sensible-utils does not validate strings before launching the program specified by the `BROWSER` environment variable. For example, a crafted URL could include a `--proxy-pac-file` argument to exploit this issue. **Recommendations** For versions prior to 0.0.11, update to version 0.0.11 or later to resolve the issue. As a temporary workaround, consider validating the `BROWSER` environment variable to prevent argument-injection attacks. Restrict access to the sensible-browser to minimize the risk of exploitation. Avoid using untrusted URLs to prevent potential attacks until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LilyPond versions prior to 2.19.80 **Description** The issue concerns the failure to validate strings before launching a program specified by the `BROWSER` environment variable. This allows remote attackers to conduct argument-injection attacks via a crafted URL, such as using the `--proxy-pac-file` argument. **Recommendations** For versions prior to 2.19.80, update to version 2.19.80 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `BROWSER` environment variable to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Thunar versions prior to 4.16.7 Thunar versions 4.17.x prior to 4.17.2 **Description** An issue was discovered in Thunar where it delegates to a different program based on the file type without user confirmation when called with a regular file as a command-line argument. This could be used to achieve code execution. The exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For Thunar versions prior to 4.16.7, update to version 4.16.7 or later. For Thunar versions 4.17.x prior to 4.17.2, update to version 4.17.2 or later.