Sebastien Renaud

**Name of the Vulnerable Software and Affected Versions** 7T Interactive Graphical SCADA System (IGSS) versions prior to 9.0.0.11143 **Description** The issue is related to an unspecified vulnerability in the Open Database Connectivity (ODBC) component. It allows remote attackers to execute arbitrary code via a crafted packet to TCP port 20222. This triggers memory corruption due to an invalid structure being used. **Recommendations** For versions prior to 9.0.0.11143, update to version 9.0.0.11143 or later to resolve the issue. As a temporary workaround, consider restricting access to TCP port 20222 to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HP OpenView Network Node Manager (OV NNM) versions 7.51 through 7.53 **Description** A buffer overflow issue allows remote attackers to execute arbitrary code via a long HTTP request to the "nnmrptconfig.exe" endpoint. **Recommendations** For HP OpenView Network Node Manager (OV NNM) versions 7.51 through 7.53, consider restricting access to the "nnmrptconfig.exe" endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** The issue arises from the Windows kernel-mode drivers not properly validating changes in certain kernel objects, allowing local users to execute arbitrary code. This could enable an attacker to run arbitrary code in kernel mode, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. **Recommendations** For Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2, update to a version that includes the fix for the improper data validation issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 4.0.5 iTunes versions prior to 9.1 **Description** The issue is related to an integer overflow in ColorSync, which allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash. This can be achieved by using an image with a crafted color profile that triggers a heap-based buffer overflow. **Recommendations** For Apple Safari versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue. For iTunes versions prior to 9.1, update to version 9.1 or later to resolve the issue.