Richard Johnson

**Name of the Vulnerable Software and Affected Versions** Cisco IOx (affected versions not specified) **Description** A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This issue is due to incomplete sanitization of parameters passed for application activation. An attacker could exploit this by deploying and activating an application with a crafted activation payload file, potentially allowing the execution of arbitrary commands as root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dnsmasq (affected versions not specified) **Description** A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq, allowing an attacker to potentially cause a denial of service by sending a crafted packet processed by dnsmasq. The flaw is related to an error in memory usage after it has been freed, specifically in the processing of DHCPv6 requests. This can be exploited by a remote attacker to send specially crafted packets, causing a use-after-free error and resulting in a denial of service attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache OpenOffice versions 4.1.2 and earlier **Description** The issue allows remote attackers to cause a denial of service or execute arbitrary code via crafted MetaActions in an ODP or OTP file. This is related to the Impress tool. **Recommendations** For versions 4.1.2 and earlier, update to a version later than 4.1.2 to resolve the issue.

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7092.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.8 **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. This allows a remote attacker to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted file. **Recommendations** For Apple QuickTime versions prior to 7.7.8, update to version 7.7.8 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted files that could trigger the buffer overflow until a patch is applied. Restrict access to potentially vulnerable components of the QuickTime package to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QuickTime (affected versions not specified) **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickTime (affected versions not specified) **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickTime (affected versions not specified) **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickTime (affected versions not specified) **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickTime (affected versions not specified) **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickTime (affected versions not specified) **Description** The issue is caused by a buffer overflow in the QuickTime multimedia package. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3668.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through R2 Microsoft Windows 7 (affected versions not specified) **Description** A denial of service issue exists due to the way the Server Message Block (SMB) Protocol software handles specially crafted SMB compounded requests. This can be exploited by sending a specially crafted network message to a computer running the Server service, allowing remote attackers to cause a system hang. No authentication is required for an attacker to exploit this issue. **Recommendations** For Microsoft Windows Vista versions SP1 through SP2, apply the recommended patch to resolve the issue. For Microsoft Windows Server 2008 versions Gold through R2, apply the recommended patch to resolve the issue. For Microsoft Windows 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.