Matt Jones

**Name of the Vulnerable Software and Affected Versions** Apache Guacamole versions 1.5.3 and older **Description** The issue arises from inconsistent handling of values received from a VNC server, which can lead to integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Approximately 29,620 results are mainly distributed in the United States, Germany, and other countries. **Recommendations** For Apache Guacamole versions 1.5.3 and older, upgrade to version 1.5.4, which fixes this issue. As a temporary workaround, consider restricting access to the VNC server to minimize the risk of exploitation. Avoid using potentially malicious or compromised VNC servers until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pidgin versions prior to 2.10.8 **Description** The issue is related to a buffer overflow in the libpurple library, specifically in the util.c file. This can be triggered by remote HTTP servers sending an invalid chunk-size field in chunked transfer-coding data, potentially leading to a denial of service or other unspecified impacts. The vulnerability is also associated with the process chuked data function, which, when exploited, could allow a remote attacker to cause a denial of service or possibly execute arbitrary code by manipulating HTTP requests. **Recommendations** For versions prior to 2.10.8, update to version 2.10.8 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP servers that may send malicious chunked transfer-coding data until the update is applied.