Eduardo Vela

**Name of the Vulnerable Software and Affected Versions** Intel Processors (affected versions not specified) **Description** A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Versões do NTFS-3G anteriores à 2022.10.3 **Descrição** Foi descoberto um estouro de buffer no NTFS-3G, que pode ser explorado por metadados maliciosos em uma imagem NTFS, levando à execução de código. Isso pode ser explorado por um invasor local se o binário ntfs-3g estiver configurado com setuid root, ou por um invasor fisicamente próximo se o software NTFS-3G estiver configurado para ser executado ao conectar um dispositivo de armazenamento externo. O problema está relacionado a erros no processamento de metadados, permitindo que um invasor execute código arbitrário. **Recomendações** Para versões do NTFS-3G anteriores à 2022.10.3, atualize para a versão 2022.10.3 ou posterior para resolver o problema. Como solução temporária, considere desativar a execução do NTFS-3G ao conectar um dispositivo de armazenamento externo e remover as permissões setuid root do binário ntfs-3g para minimizar o risco de exploração. Restrinja o acesso ao utilitário ntfs-3g para prevenir possíveis ataques.

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.2.11 **Description** The issue is related to an integer overflow in the `xml utf8 decode` function, which can be exploited by remote attackers using a crafted string with overlong UTF-8 encoding. This allows attackers to bypass protection mechanisms against cross-site scripting (XSS) and SQL injection. **Recommendations** For PHP versions prior to 5.2.11, update to version 5.2.11 or later to resolve the issue. As a temporary workaround, consider restricting input to prevent the use of overlong UTF-8 encoding.

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 9.0.124.0 and earlier Description: The issue allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements. This can be used to hijack the camera or microphone and is related to "clickjacking." Recommendations: For Adobe Flash Player versions 9.0.124.0 and earlier, update to a version later than 9.0.124.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 7 through 8 **Description** A cross-domain issue allows remote attackers to change the location property of a frame via the Object data type. This can be used to observe domain-independent events, such as onkeydown events, using a frame from a different domain. **Recommendations** For Microsoft Internet Explorer versions 7 and 8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 6 through 7 **Description** A cross-domain issue allows remote attackers to change the location property of a frame via the String data type. This can be used to observe domain-independent events, such as onkeydown events, using a frame from a different domain. **Recommendations** For Microsoft Internet Explorer versions 6 through 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.