S3Tm3M

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions prior to 18.0.0.268 Adobe Flash Player versions 19.x Adobe Flash Player versions 20.x prior to 20.0.0.228 Adobe AIR versions prior to 20.0.0.204 Adobe AIR SDK versions prior to 20.0.0.204 Adobe AIR SDK & Compiler versions prior to 20.0.0.204 Adobe Flash Player versions prior to 11.2.202.554 on Linux **Description** The issue is caused by a stack-based buffer overflow, allowing attackers to execute arbitrary code via unspecified vectors. This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For Adobe Flash Player versions prior to 18.0.0.268, update to version 18.0.0.268 or later. For Adobe Flash Player versions 19.x, update to a version that is not affected by this issue. For Adobe Flash Player versions 20.x prior to 20.0.0.228, update to version 20.0.0.228 or later. For Adobe AIR versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK & Compiler versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe Flash Player versions prior to 11.2.202.554 on Linux, update to version 11.2.202.554 or later.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.9.5 QuickTime versions prior to the fixed version **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MIDI file. This is due to a buffer overflow in the QT Media Foundation. **Recommendations** For Apple OS X versions prior to 10.9.5, update to version 10.9.5 or later to resolve the issue. For QuickTime, update to a version that includes the fix for this buffer overflow issue. As a temporary workaround, consider avoiding the use of crafted MIDI files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Word versions 2007 SP3 Office Compatibility Pack version SP3 **Description** The issue is related to errors that occur when processing specially crafted files, allowing a remote attacker to execute arbitrary code and gain full control over the system. This can be achieved through crafted embedded fonts in .doc or .docx documents. An attacker who successfully exploits this issue could install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights. **Recommendations** For Microsoft Word 2007 SP3, consider applying the necessary security updates to resolve the issue. For Office Compatibility Pack SP3, apply the relevant patches to fix the vulnerability. As a temporary workaround, consider restricting the use of embedded fonts in documents until a patch is available.