Hanno Boeck

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 149 Thunderbird versions prior to 149 **Description** A denial-of-service issue exists in the XML component. **Recommendations** Update Firefox to version 149 or later. Update Thunderbird to version 149 or later.

**Name of the Vulnerable Software and Affected Versions** Claws Mail versions prior to 3.17.7 **Description** A malicious IMAP server can cause stack consumption in Claws Mail due to unlimited recursion into subdirectories during a rebuild of the folder tree. This occurs in the `imap scan tree recursive` function. **Recommendations** For Claws Mail versions prior to 3.17.7, update to version 3.17.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 52.9 **Description** The issue is related to a lack of protection for sensitive data in the Thunderbird email client. It can be exploited by a remote attacker to gain unauthorized access to protected information. This can happen when a user submits an embedded form by pressing the enter key within a text input field, potentially leaking plaintext of decrypted emails. **Recommendations** For versions prior to 52.9, update to version 52.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GNU patch versions prior to 2.7.6 **Description** The issue is related to out-of-bounds access within the `pch write line()` function in `pch.c`, which can lead to a denial of service (DoS) via a crafted input file. **Recommendations** For versions prior to 2.7.6, update to version 2.7.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GNU patch versions prior to 2.7.7 **Description** The issue is related to a segmentation fault and a NULL pointer dereference in the `intuit diff type()` function in `pch.c`, which can lead to a denial of service. This is also referred to as a "mangled rename" issue. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For GNU patch versions prior to 2.7.7, update to version 2.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the `intuit diff type()` function in `pch.c` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GNU patch versions through 2.7.6 **Description** A double free issue exists in the `another hunk` function in `pch.c`, which can be exploited by a remote attacker to cause a denial of service. **Recommendations** For GNU patch versions through 2.7.6, update to a version later than 2.7.6 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Irssi versions prior to 1.0.5 **Description** The issue arises when installing themes with unterminated colour formatting sequences, potentially causing access to data beyond the end of the string. **Recommendations** For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libbsd versions prior to 0.8.2 **Description** The issue is related to an off-by-one vulnerability in the fgetwln function, which can trigger a heap-based buffer overflow. This allows attackers to have an unspecified impact via unknown vectors. **Recommendations** For versions prior to 0.8.2, update to version 0.8.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GStreamer versions prior to 1.10.2 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash due to a NULL pointer dereference, via a crafted file. This is related to the ` parse pat` function in the `mpegts` parser. **Recommendations** For versions prior to 1.10.2, update to version 1.10.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libxml2 versions prior to 2.9.3 **Description** The issue allows context-dependent attackers to obtain sensitive information via an unterminated encoding value or incomplete XML declaration in XML data, triggering an out-of-bounds heap read. This can be exploited by a remote attacker to gain confidential information. **Recommendations** For versions prior to 2.9.3, update to version 2.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the xmlParseXMLDecl function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache httpd versions 2.2.x through 2.2.32 Apache httpd versions 2.4.x through 2.4.25 **Description** The issue is caused by a buffer overflow in the mod mime module when handling a malicious Content-Type response header. This can allow a remote attacker to crash the HTTPD child process using a specially crafted header. **Recommendations** For Apache httpd versions 2.2.x through 2.2.32, update to version 2.2.33 or later. For Apache httpd versions 2.4.x through 2.4.25, update to version 2.4.26 or later.

**Name of the Vulnerable Software and Affected Versions** phpList versions prior to 2.10.13 **Description** The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that add or edit administrator accounts. **Recommendations** For versions prior to 2.10.13, update to version 2.10.13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple versions prior to 1.7.1 **Description** A cross-site scripting issue exists, potentially allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `date format string` parameter in the admin/editprefs.php file in the backend. **Recommendations** For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/editprefs.php file to minimize the risk of exploitation. Avoid using the `date format string` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Joomla! version 1.5.8 **Description** The issue makes it easier for remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag is not set for the session cookie in an https session. **Recommendations** For version 1.5.8, consider updating the session cookie handling to set the secure flag when transmitting over https to prevent interception.

**Name of the Vulnerable Software and Affected Versions** cpCommerce versions prior to 1.2.4 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `search` parameter in a "search.quick" action to "search.php" and the `name` parameter in a "sendtofriend" action to "sendtofriend.php". **Recommendations** For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "search.php" and "sendtofriend.php" files until the update is applied. Avoid using the `search` and `name` parameters in the affected API endpoints until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Mantis versions 1.1.x through 1.1.2 Mantis versions 1.2.x through 1.2.0a2 Description: The issue arises because the secure flag is not set for the session cookie in an https session. This can cause the cookie to be sent in http requests, making it easier for remote attackers to capture the cookie. Recommendations: For versions 1.1.x through 1.1.2, update the configuration to set the secure flag for the session cookie. For versions 1.2.x through 1.2.0a2, update the configuration to set the secure flag for the session cookie.

**Name of the Vulnerable Software and Affected Versions** Squirrelmail version 1.4.15 **Description** The issue is related to the session cookie in https sessions. Specifically, the secure flag is not set for the session cookie, which can cause the cookie to be sent in http requests. This makes it easier for remote attackers to capture the cookie. **Recommendations** For Squirrelmail version 1.4.15, consider updating to a version that sets the secure flag for the session cookie in https sessions to prevent the cookie from being sent in http requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: fuzzylime (cms) versions prior to 3.03 Description: The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the `user` parameter to the login form. Recommendations: For versions prior to 3.03, update to version 3.03 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/usercheck.php file to minimize the risk of exploitation. Avoid using the `user` parameter in the login form until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 5.10 and 6.4 **Description** The issue is related to the session cookie in https sessions. Specifically, the secure flag for the session cookie is not set, which can cause the cookie to be sent in http requests. This makes it easier for remote attackers to capture the cookie. **Recommendations** For versions 5.10 and 6.4, set the secure flag for the session cookie in https sessions to prevent it from being sent in http requests.

**Name of the Vulnerable Software and Affected Versions** ClamAV versions prior to 0.94 **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash, by providing a malformed CHM file. This is related to an invalid memory access in the chm-parser. **Recommendations** For versions prior to 0.94, update to version 0.94 or later to resolve the issue.