Marc Heuse

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unavailability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server (affected versions not specified) Description: The issue allows an attacker to consume all available session slots, blocking other users from logging in and preventing legitimate users from accessing the product. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows an attacker with physical access to the JTAG interface to inject or modify firmware. This could be achieved through successful exploitation of the vulnerability, potentially leading to unauthorized modifications of the device's firmware. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: jpeg-xl versions through 0.3.2 Description: The issue allows for writable memory corruption. Recommendations: For versions through 0.3.2, update to a version later than 0.3.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 10 Apple OS X versions prior to 10.12 Apple tvOS versions prior to 10 Apple watchOS versions prior to 3 **Description** The issue allows remote attackers to cause a denial of service, resulting in an unintended lock, via unspecified vectors. **Recommendations** For Apple iOS versions prior to 10, update to version 10 or later. For Apple OS X versions prior to 10.12, update to version 10.12 or later. For Apple tvOS versions prior to 10, update to version 10 or later. For Apple watchOS versions prior to 3, update to version 3 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 7 **Description** The issue is related to the IPv6 implementation in the kernel, which allows remote attackers to cause a denial of service by consuming CPU resources via crafted ICMPv6 packets. **Recommendations** For Apple iOS versions prior to 7, update to version 7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) NetBSD (affected versions not specified) **Description** The issue affects the Neighbor Discovery protocol implementation in the IPv6 stack, allowing remote attackers to cause a denial of service by sending many Router Advertisement messages with different source addresses. This results in CPU consumption and device hang. **Recommendations** For FreeBSD, update to a version that includes a fix for this issue. For NetBSD, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the IPv6 stack to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent. This can be demonstrated using tools like thcping when the Linux kernel is using IPv6. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping. NOTE: due to a typo, some sources map CVE-2010-4562 to a ProFTPd mod sql vulnerability, but that issue is covered by CVE-2010-4652.

**Name of the Vulnerable Software and Affected Versions** Cisco IOS (affected versions not specified) **Description** The issue concerns the Neighbor Discovery (ND) protocol implementation, which allows remote attackers to bypass the Router Advertisement Guarding functionality. This can be achieved via a fragmented IPv6 packet where the Router Advertisement (RA) message is contained in the second fragment. There are two demonstrated methods: (1) using a packet where the first fragment contains a long Destination Options extension header, or (2) using a packet where the first fragment contains an ICMPv6 Echo Request message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QNAP TS-239 Pro versions 2.1.7 0613, 3.1.0 0627, 3.1.1 0815 QNAP TS-639 Pro versions 2.1.7 0613, 3.1.0 0627, 3.1.1 0815 **Description** The issue allows local users to bypass the passphrase requirement and decrypt the hard drive. This is achieved by reading the undocumented recovery key stored in the `ENCK` variable in flash memory, deobfuscating the key, and running a cryptsetup luksOpen command. **Recommendations** For QNAP TS-239 Pro and TS-639 Pro versions 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815, consider restricting access to the flash memory to prevent unauthorized users from reading the `ENCK` variable. As a temporary workaround, limit local user privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.