Yiheng Cao

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1.* through 8.1.30 PHP versions 8.2.* through 8.2.25 PHP versions 8.3.* through 8.3.13 Description: The issue is related to the ldap escape() function in PHP, which can cause an integer overflow when given uncontrolled long string inputs on 32-bit systems, resulting in an out-of-bounds write. This can allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is over 700,000 instances. Recommendations: For PHP versions 8.1.* through 8.1.30, update to version 8.1.31 or later. For PHP versions 8.2.* through 8.2.25, update to version 8.2.26 or later. For PHP versions 8.3.* through 8.3.13, update to version 8.3.14 or later. As a temporary workaround, consider disabling the `ldap escape()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WeeChat versions prior to 4.4.2 **Description** The issue is caused by an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects functions such as `string free split shared`, `string free split`, `string free split command`, and `string free split tags`. **Recommendations** For WeeChat versions prior to 4.4.2, update to version 4.4.2 or later to resolve the issue. As a temporary workaround, consider limiting the number of items in a list to prevent the integer overflow.

**Name of the Vulnerable Software and Affected Versions** Apache Pulsar versions prior to 2.11.3 Apache Pulsar versions prior to 3.0.2 Apache Pulsar versions prior to 3.1.1 **Description** The issue is related to an observable timing discrepancy vulnerability in the Apache Pulsar SASL Authentication Provider, which can allow an attacker to forge a SASL Role Token that will pass signature verification. This vulnerability may impact the confidentiality and integrity of protected information. **Recommendations** For Apache Pulsar version 2.11, upgrade to at least version 2.11.3. For Apache Pulsar version 3.0, upgrade to at least version 3.0.2. For Apache Pulsar version 3.1, upgrade to at least version 3.1.1. For any versions prior to 2.11.3, 3.0.2, or 3.1.1, consider upgrading to one of the above patched versions and update the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 8.5.0 through 8.5.92 Apache Tomcat versions 9.0.0-M1 through 9.0.79 Apache Tomcat versions 10.1.0-M1 through 10.0.12 Apache Tomcat versions 11.0.0-M1 through 11.0.0-M10 **Description** The issue is related to a URL redirection vulnerability in the FORM authentication feature of Apache Tomcat, which can allow a remote attacker to redirect users to an arbitrary URL. This vulnerability is limited to the ROOT (default) web application. If the ROOT web application is configured to use FORM authentication, a specially crafted URL could be used to trigger a redirect to an URL of the attacker's choice. **Recommendations** For Apache Tomcat versions 8.5.0 through 8.5.92, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 9.0.0-M1 through 9.0.79, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 10.1.0-M1 through 10.0.12, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 11.0.0-M1 through 11.0.0-M10, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the FORM authentication feature in the ROOT web application until a patch is available.