Marc Schoenefeld

**Name of the Vulnerable Software and Affected Versions** GarageBand versions prior to 10.4.12 **Description** The issue was addressed with improved bounds checks. Processing a maliciously crafted image may lead to arbitrary code execution. The problem was fixed by improving bounds checks, and it was reported by Mark Schenfeld, Ph.D. **Recommendations** For GarageBand versions prior to 10.4.12, update to version 10.4.12 to resolve the issue. As a temporary workaround, consider avoiding the processing of images from untrusted sources until the update is applied.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Thunderbird versions prior to 133 Description: A null pointer dereference may have occurred in the `pk12util` tool, specifically in the `SEC ASN1DecodeItem Util` function, when handling malformed or improperly formatted input files. This issue can potentially allow a remote attacker to cause a denial of service. Recommendations: For Firefox versions prior to 133, update to a version that includes the fix for this issue. For Thunderbird versions prior to 133, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the `pk12util` tool and the `SEC ASN1DecodeItem Util` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GarageBand versions prior to 10.4.11 **Description** A use-after-free issue was addressed with improved memory management. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. This issue affects macOS Sonoma and Ventura users. **Recommendations** For GarageBand versions prior to 10.4.11, update to version 10.4.11 to resolve the issue. As a temporary workaround, consider avoiding the processing of maliciously crafted files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 15.4 iOS versions prior to 15.4 iPadOS versions prior to 15.4 watchOS versions prior to 8.5 **Description** A memory corruption issue was addressed with improved validation. Processing a maliciously crafted image may lead to heap corruption. **Recommendations** For tvOS versions prior to 15.4, update to tvOS 15.4 to resolve the issue. For iOS versions prior to 15.4, update to iOS 15.4 to resolve the issue. For iPadOS versions prior to 15.4, update to iPadOS 15.4 to resolve the issue. For watchOS versions prior to 8.5, update to watchOS 8.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** JBoss BRMS versions prior to 5.1.0 **Description** The issue is related to a XSS vulnerability. It can be exploited via the `asset` parameter, specifically when using a `UUID` value. **Recommendations** For versions prior to 5.1.0, update to version 5.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameter `asset` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JBoss ON versions 2.1.x through 2.1.2 before SP1 **Description** The issue allows users to obtain unauthorized security information about private resources managed by JBoss ON. **Recommendations** For JBoss ON versions 2.1.x through 2.1.2 before SP1, update to at least version 2.1.2 SP1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** IcedTea6 versions prior to 1.7.4 **Description** The issue allows unsigned apps to read and write arbitrary files due to improper checking of property access. **Recommendations** For versions prior to 1.7.4, update to version 1.7.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache jUDDI version 3.0.0 **Description** The issue concerns the console in Apache jUDDI, which fails to properly escape line feeds. This allows remote authenticated users to spoof log entries by manipulating the `numRows` parameter. **Recommendations** For Apache jUDDI version 3.0.0, consider restricting access to the console until a proper fix is available, and avoid using the `numRows` parameter in a way that could facilitate log entry spoofing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.3 Apple OS X versions prior to 10.10.3 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted font file. **Recommendations** For Apple iOS versions prior to 8.3, update to version 8.3 or later. For Apple OS X versions prior to 10.10.3, update to version 10.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** Red Hat JBoss BRMS versions prior to 6.0.1 Red Hat JBoss BPM Suite versions prior to 6.0.1 JBoss Drools (affected versions not specified) **Description** The issue allows remote authenticated users to execute arbitrary Java code. This can be achieved via either MVFLEX Expression Language (MVEL) or Drools expressions. **Recommendations** For Red Hat JBoss BRMS versions prior to 6.0.1, update to version 6.0.1 or later. For Red Hat JBoss BPM Suite versions prior to 6.0.1, update to version 6.0.1 or later. For JBoss Drools, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** icclib versions prior to 2.13 Argyll CMS versions prior to 1.4 **Description** The issue is related to a use-after-free vulnerability that can be triggered by a crafted ICC profile file, potentially allowing remote attackers to cause a denial of service or execute arbitrary code. **Recommendations** For icclib versions prior to 2.13, update to version 2.13 or later. For Argyll CMS versions prior to 1.4, update to version 1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Mac OS X versions prior to 10.7.3 **Description** The issue is related to the OpenGL implementation, which does not properly perform OpenGL Shading Language compilation. This allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted program. **Recommendations** For versions prior to 10.7.3, update to Mac OS X 10.7.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android SDK versions prior to 2.3 **Description** The issue is related to the dexdump tool in the Android SDK, which does not properly perform structural verification. This allows user-assisted remote attackers to cause a denial of service, potentially leading to a crash, and possibly execute arbitrary code via a malformed APK or dex file. The attack vector involves a dex file that calls a method using more arguments than the number of registers declared for that method. **Recommendations** For Android SDK versions prior to 2.3, update to version 2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X versions prior to 10.6.7 **Description** The issue is related to multiple buffer overflows in Apple Type Services (ATS) that allow remote attackers to execute arbitrary code. This can be achieved by using a document containing a crafted embedded TrueType font. **Recommendations** For versions prior to 10.6.7, update to version 10.6.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X versions prior to 10.6.7 **Description** The issue is related to multiple buffer overflows in Apple Type Services (ATS) that allow remote attackers to execute arbitrary code. This can be achieved by providing a document containing a crafted SFNT table in an embedded font. **Recommendations** For versions prior to 10.6.7, update to version 10.6.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X versions prior to 10.6.7 **Description** A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a document containing a crafted embedded OpenType font. **Recommendations** For Apple Mac OS X versions prior to 10.6.7, update to version 10.6.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions prior to 1.2 **Description** The issue is related to a heap-based buffer overflow in the wiretap/pcapng.c file, which can be triggered by a crafted capture file. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code. **Recommendations** For versions prior to 1.2, update to version 1.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** IcedTea-Web versions prior to 1.0.1 OpenJDK Runtime Environment version 1.6.0 **Description** The issue allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of an inappropriate security descriptor in the JNLPClassLoader class. **Recommendations** For IcedTea-Web versions prior to 1.0.1, update to version 1.0.1 or later. For OpenJDK Runtime Environment version 1.6.0, consider upgrading to a newer version that incorporates the fix for this issue.

**Name of the Vulnerable Software and Affected Versions** OpenOffice.org versions 2.x through 3.x prior to 3.3 **Description** The issue is related to multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to add and execute commands of their choice through the use of .. (dot dot) in the `site` parameter to (1) "index.php" and (2) "admin.php". Additionally, attackers can overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files. This could potentially allow a remote attacker to access confidential data, disrupt its integrity, and cause a denial of service. **Recommendations** For OpenOffice.org versions 2.x through 3.x prior to 3.3, update to version 3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the XSLT JAR filter and Extension (aka OXT) files until a patch is available. Avoid using the `site` parameter in the affected API endpoints "index.php" and "admin.php" until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenOffice.org (OOo) versions 2.x through 3.x before 3.3 **Description** The issue is related to a heap-based buffer overflow in Impress, which can be triggered by a crafted PNG file in an ODF or Microsoft Office document. This can cause a denial of service, resulting in an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited by a remote attacker, potentially leading to unauthorized access to confidential data, disruption of service, or impact on data integrity. **Recommendations** For OpenOffice.org (OOo) versions 2.x through 3.x before 3.3, update to version 3.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted PNG files in ODF or Microsoft Office documents until a patch is applied. Restrict access to potentially vulnerable documents to minimize the risk of exploitation.