Kai Lu

**Name of the Vulnerable Software and Affected Versions** Windows Media (affected versions not specified) **Description** A heap-based buffer overflow exists in Windows Media that could allow an unauthorized attacker to execute code locally. Remote attackers may be able to execute arbitrary code and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA Toolkit (affected versions not specified) **Description** The NVIDIA CUDA Toolkit contains an issue in the nvdisasm binary. A user can trigger an out-of-bounds read by providing a specially crafted ELF file to nvdisasm. Exploitation of this issue may result in a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Media (affected versions not specified) Description: A heap-based buffer overflow exists in Windows Media, potentially allowing an unauthorized attacker to execute code over a network. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit (affected versions not specified) **Description** The issue is related to an out-of-bounds read in the cuobjdump binary. This can be triggered by passing a malformed ELF file to cuobjdump, potentially leading to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit (affected versions not specified) **Description** The issue is related to an out-of-bounds read in the cuobjdump binary of the NVIDIA CUDA toolkit. This can be triggered by passing a malformed ELF file to cuobjdump, potentially leading to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit for Windows (affected versions not specified) **Description** The issue is related to the cuobjdump binary in the NVIDIA CUDA toolkit for Windows, where passing a malformed ELF file could cause an out-of-bounds read. This might lead to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit (affected versions not specified) **Description** The issue is related to an out-of-bounds read in the cuobjdump binary of the NVIDIA CUDA toolkit. This can be triggered by passing a malformed ELF file to cuobjdump, potentially leading to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit (affected versions not specified) **Description** The issue is related to the nvdisasm binary in the NVIDIA CUDA toolkit, where passing a malformed ELF file could cause an out-of-bounds read. This might lead to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA Toolkit (affected versions not specified) **Description** A vulnerability has been identified in the NVIDIA CUDA Toolkit. The issue was disclosed on 2024-10-03, and a patch is expected in February 2025. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit (affected versions not specified) **Description** The issue is related to the nvdisasm binary in the NVIDIA CUDA toolkit, where passing a malformed ELF file could cause an out-of-bounds read, potentially leading to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to a memory buffer overflow in Microsoft Office, which can allow an attacker to execute arbitrary code. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Office packages. Exploitation of this issue may allow an attacker to execute arbitrary code using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Office, which can be exploited to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.6.8 macOS versions prior to 12.5 **Description** An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted Postscript file may result in unexpected app termination or disclosure of process memory. **Recommendations** For macOS versions prior to 11.6.8, update to macOS Big Sur 11.6.8 or later. For macOS versions prior to 12.5, update to macOS Monterey 12.5 or later. As a temporary workaround, consider avoiding the processing of Postscript files from untrusted sources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14.4 **Description** The issue arises from multiple memory corruption problems that have been resolved through enhanced input validation. Processing malicious data may cause unexpected application termination. **Recommendations** For versions prior to 10.14.4, update to macOS Mojave 10.14.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-08-01 **Description** The issue is related to the ih264d decoder in the mediaserver of Android, which mishandles slice numbers. This allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. **Recommendations** For Android versions prior to 2016-08-01, update the operating system to a version released after 2016-08-01 to resolve the issue. As a temporary workaround, consider avoiding the use of crafted media files that could exploit the vulnerability in the ih264d decoder.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader Document Cloud and Adobe Reader (affected versions not specified) Adobe Acrobat and Adobe Acrobat Document Cloud (affected versions not specified) **Description** The issue is caused by a buffer overflow, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) through unknown vectors. A memory corruption vulnerability in Adobe Acrobat and Reader enables attackers to execute code. **Recommendations** For Adobe Reader Document Cloud and Adobe Reader, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Acrobat and Adobe Acrobat Document Cloud, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.8 **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. This allows a remote attacker to execute arbitrary code or cause a denial of service, such as memory corruption and application crash, via a crafted file. **Recommendations** For Apple QuickTime versions prior to 7.7.8, update to version 7.7.8 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted files that could trigger the buffer overflow until a patch is applied.

QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3667.

QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3668.