Anibal Sacco

**Name of the Vulnerable Software and Affected Versions** AVTECH AVN801 DVR versions 1017-1003-1009-1003 and earlier **Description** The issue is related to a buffer overflow in the RTSP Packet Handler, which can be triggered by a long string in the URI in an RTSP SETUP request, such as "/rtsp/setup". This can cause a denial of service, resulting in a device crash, and potentially allow the execution of arbitrary code. **Recommendations** For AVTECH AVN801 DVR versions 1017-1003-1009-1003 and earlier, update the firmware to a version later than 1017-1003-1009-1003 to resolve the issue. As a temporary workaround, consider restricting access to the RTSP SETUP request to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X version 10.5.8 **Description** The issue is related to an integer signedness error in Apple Type Services (ATS), which can be exploited by remote attackers to execute arbitrary code. This can be achieved by using a crafted embedded Compact Font Format (CFF) font in a document. **Recommendations** For Apple Mac OS X version 10.5.8, consider avoiding the use of embedded CFF fonts in documents until a fix is available. As a temporary workaround, restrict the opening of documents from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CUPS versions prior to 1.3.10 **Description** The issue is related to the ippReadIO function in cups/ipp.c, which does not properly initialize memory for IPP request packets. This allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and daemon crash, via a scheduler request with two consecutive IPP TAG UNSUPPORTED tags. **Recommendations** For versions prior to 1.3.10, update to version 1.3.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the scheduler request to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VirtualBox versions prior to 1.6.4 **Description** The issue is related to insufficient input validation in the VBoxDrvNtDeviceControl function in VBoxDrv.sys. This function uses the METHOD NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object. As a result, local users can gain privileges by opening the .VBoxDrv device and calling DeviceIoControl to send a crafted kernel address. **Recommendations** For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the .VBoxDrv device to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Rising Antivirus 2008 versions prior to 20.38.20 **Description** The issue allows local users to cause a denial of service, resulting in a system crash. This is achieved by providing an invalid pointer to the ` CLIENT ID` structure in a call to the `NtOpenProcess` function, which is hooked in the System Service Descriptor Table (SSDT). **Recommendations** For Rising Antivirus 2008 versions prior to 20.38.20, update to version 20.38.20 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Comodo Firewall Pro versions prior to 3.0 **Description** The issue arises from improper validation of certain parameters to hooked System Service Descriptor Table (SSDT) functions. This can be exploited by local users to cause a denial of service, resulting in a system crash. The exploitation vectors include a crafted `OBJECT ATTRIBUTES` structure in a call to the `NtDeleteFile` function, leading to improper validation of a `ZwQueryObject` result, as well as unspecified calls to the `NtCreateFile` and `NtSetThreadContext` functions. **Recommendations** For Comodo Firewall Pro versions prior to 3.0, update to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `NtDeleteFile`, `NtCreateFile`, and `NtSetThreadContext` functions to minimize the risk of exploitation. Additionally, avoid using crafted `OBJECT ATTRIBUTES` structures in calls to the `NtDeleteFile` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** VLC media player versions 0.8.6d and earlier Miro Player versions 1.1 and earlier **Description** The issue allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file. This is related to the MP4 demuxer (mp4.c) in VLC media player when used in Miro Player. **Recommendations** For VLC media player versions 0.8.6d and earlier, update to a version later than 0.8.6d to resolve the issue. For Miro Player versions 1.1 and earlier, update to a version later than 1.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the MP4 demuxer (mp4.c) in VLC media player until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MPlayer versions 1.0 rc2 and earlier **Description** The issue is related to an array index error in the libmpdemux/demux mov.c file, which could potentially allow remote attackers to execute arbitrary code. This is possible through a crafted QuickTime MOV file that contains a specifically designed stsc atom tag. **Recommendations** For MPlayer versions 1.0 rc2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.