Robert Swiecki

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions prior to 2.4.30 **Description** A specially crafted request could crash the server due to an out of bound access after a size limit is reached by reading the HTTP header. This issue is considered very hard if not impossible to trigger in non-debug mode, so it is classified as low risk for common server usage. The issue is related to an out of bound access in memory after reaching the size limit by reading the HTTP header, which could allow a remote attacker to cause a denial of service. **Recommendations** For versions prior to 2.4.30, update to version 2.4.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the server or implementing additional security measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 0.9.8 through 0.9.8zg OpenSSL versions 1.0.0 through 1.0.0s OpenSSL versions 1.0.1 through 1.0.1n OpenSSL versions 1.0.2 through 1.0.2b **Description** The issue is related to the X509 cmp time function, which does not properly check the length of the ASN1 TIME string and can read a few bytes out of bounds. This can allow remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1 TIME data. The vulnerability can be exploited by an unauthenticated, remote attacker to cause a denial of service (DoS) condition or corrupt portions of OpenSSL process memory. **Recommendations** For OpenSSL versions 0.9.8 through 0.9.8zg, update to version 0.9.8zg or later. For OpenSSL versions 1.0.0 through 1.0.0s, update to version 1.0.0s or later. For OpenSSL versions 1.0.1 through 1.0.1n, update to version 1.0.1n or later. For OpenSSL versions 1.0.2 through 1.0.2b, update to version 1.0.2b or later. As a temporary workaround, consider restricting the use of the X509 cmp time function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 6 through 9 **Description** The issue allows remote attackers to read content from a different domain or zone via a crafted web site. An information disclosure vulnerability exists that could allow an attacker to force the browser to perform unexpected actions when a user downloads Web content, allowing an attacker to view content from a different domain or Internet Explorer zone other than the domain or zone of the attacker's Web page. **Recommendations** For Microsoft Internet Explorer versions 6 through 9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.39 kernel-kdumppae (affected versions not specified) **Description** The issue is related to an integer overflow in the Linux kernel, specifically in the vma to resize function in mm/mremap.c, which can be exploited by local users to cause a denial of service, resulting in a system crash. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise that can be exploited remotely, potentially leading to a disruption of protected information. **Recommendations** For Linux kernel versions prior to 2.6.39, update to version 2.6.39 or later to resolve the issue. For kernel-kdumppae, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.38.4 **Description** The issue is related to multiple integer overflows in the next pidmap function in kernel/pid.c, which can cause a denial of service (system crash) via crafted system calls, specifically (1) getdents or (2) readdir. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise that can lead to disruption of protected information availability, and these can be exploited remotely. **Recommendations** For Linux kernel versions prior to 2.6.38.4, update to version 2.6.38.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `next pidmap` function in kernel/pid.c to minimize the risk of exploitation. Avoid using the `getdents` and `readdir` system calls in the affected kernel versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.35.5 **Description** The issue is related to the handling of interaction between mutex possession and llseek operations in the Linux kernel when debugfs is enabled. This can be exploited by local users to cause a denial of service, resulting in a NULL pointer dereference and outage of all function tracing files, via an lseek call on a file descriptor associated with the set ftrace filter file. **Recommendations** For Linux kernel versions prior to 2.6.35.5, update to version 2.6.35.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** freetype versions prior to 2.4.8 freetype versions prior to 2.4.2 **Description** The issue affects the freetype package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. A buffer overflow in the `Mac Read POST Resource` function in `base/ftobjs.c` allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted Adobe Type 1 Mac Font File. **Recommendations** For versions prior to 2.4.2, consider updating to version 2.4.2 or later to resolve the buffer overflow issue in the `Mac Read POST Resource` function. For versions prior to 2.4.8, update to version 2.4.8 or later to address the multiple vulnerabilities. As a temporary workaround, consider restricting the use of crafted Adobe Type 1 Mac Font Files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.8 FreeType versions prior to 2.4.2 **Description** The issue is related to multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, FreeType before version 2.4.2 uses incorrect integer data types during bounds checking. This can allow remote attackers to cause a denial of service, such as an application crash, or possibly execute arbitrary code via a crafted font file. **Recommendations** For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue. For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted font files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue is related to an integer underflow in glyph handling, which can be exploited by remote attackers using a crafted font file. This can lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely and may compromise the confidentiality, integrity, and availability of protected information. **Recommendations** For FreeType versions prior to 2.4.0, update to version 2.4.0 or later. For FreeType versions prior to 2.4.8, update to version 2.4.8 or later. As a temporary workaround, consider restricting the use of crafted font files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** freetype versions prior to 2.4.8 **Description** The issue concerns multiple vulnerabilities in the freetype package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A heap-based buffer overflow in the `Ins IUP` function in `truetype/ttinterp.c` can occur when TrueType bytecode support is enabled, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. **Recommendations** For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider disabling TrueType bytecode support until a patch is available. Restrict access to font files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue concerns multiple buffer overflows in demo programs within FreeType, potentially allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. Exploitation of the vulnerabilities may lead to breaches in confidentiality, integrity, and availability of protected information, and can be carried out remotely. **Recommendations** For FreeType versions prior to 2.4.0, update to version 2.4.0 or later. For FreeType versions prior to 2.4.8, update to version 2.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** freetype versions prior to 2.4.8 freetype versions prior to 2.4.0 **Description** The issue concerns multiple vulnerabilities in the freetype package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the `psh glyph find strong points` function in `pshinter/pshalgo.c` does not properly implement hinting masks, allowing remote attackers to cause a denial of service, such as heap memory corruption and application crash, or possibly execute arbitrary code via a crafted font file that triggers an invalid free operation. **Recommendations** For versions prior to 2.4.0, consider updating to version 2.4.0 or later to address the issue with the `psh glyph find strong points` function. For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the multiple vulnerabilities in the freetype package. As a temporary workaround, consider restricting the use of crafted font files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.8 FreeType versions prior to 2.4.0 **Description** The issue concerns multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A buffer overflow in the `Mac Read POST Resource` function in `base/ftobjs.c` allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment. **Recommendations** For FreeType versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. For FreeType versions prior to 2.4.0, update to version 2.4.0 or later to address the buffer overflow vulnerability in the `Mac Read POST Resource` function. As a temporary workaround, consider restricting the use of crafted LaserWriter PS font files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue is related to an integer overflow in the gray render span function in smooth/ftgrays.c, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. Multiple vulnerabilities in the freetype package may lead to violations of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely. **Recommendations** For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted font files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue is related to a heap-based buffer overflow in the Mac Read POST Resource function in base/ftobjs.c, which can be triggered by a crafted length value in a POST fragment header in a font file. This can cause a denial of service, such as an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely. **Recommendations** For versions prior to 2.4.0, update to version 2.4.0 or later. For versions prior to 2.4.8, update to version 2.4.8 or later. As a temporary workaround, consider restricting access to font files or disabling the Mac Read POST Resource function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 4.0.5 **Description** The issue in the Cascading Style Sheets (CSS) implementation allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via crafted format arguments. **Recommendations** For versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Opera versions prior to 9.63 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates. **Recommendations** For versions prior to 9.63, update to version 9.63 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: ImageIO in Apple Mac OS X versions 10.4.11 and 10.5 through 10.5.4 Description: The issue allows context-dependent attackers to cause a denial of service, resulting in memory corruption and application crash, or execute arbitrary code via a crafted TIFF image. Recommendations: For Mac OS X 10.4.11, update to a version that fixes the issue. For Mac OS X versions 10.5 through 10.5.4, update to a version that fixes the issue. As a temporary workaround, consider avoiding the use of crafted TIFF images until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 3.1 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page, affecting Apple Safari when running on Windows XP or Vista. **Recommendations** For versions prior to 3.1, update to version 3.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** KDE Konqueror version 3.5.7 **Description** A visual truncation issue allows remote attackers to spoof the URL address bar by using an http URI with a large amount of whitespace in the `user/password` portion. **Recommendations** For KDE Konqueror version 3.5.7, consider updating to a newer version that addresses this issue, as using an http URI with excessive whitespace in the `user/password` portion can lead to URL address bar spoofing.