Ville Skyttä

**Name of the Vulnerable Software and Affected Versions** alsa-utils versions 1.0.19 and later **Description** The issue allows local users to overwrite arbitrary files via a symlink attack. This is possible through the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts. **Recommendations** For alsa-utils versions 1.0.19 and later, consider restricting access to the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cacti version 0.8.6i Description: The issue allows remote authenticated users to cause a denial of service, specifically CPU consumption, by providing a large value for the `graph start` or `graph end` parameter in the graph image.php file. Recommendations: For Cacti version 0.8.6i, consider restricting access to the graph image.php file or limiting the values that can be passed to the `graph start` and `graph end` parameters to prevent excessive CPU consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cacti version 0.8.6i Description: The issue allows remote authenticated users to cause a denial of service, specifically CPU consumption, by providing a large value for the `graph height` or `graph width` parameter. Recommendations: For version 0.8.6i, restrict the input values for the `graph height` and `graph width` parameters to prevent excessive CPU consumption. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: ProFTPD version 1.3.0 and earlier Description: The issue is related to a stack-based buffer overflow in the sreplace function, which can be exploited by remote attackers to cause a denial of service and potentially execute arbitrary code. This can lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely. Recommendations: For ProFTPD version 1.3.0 and earlier, update to a version later than 1.3.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.