Winmin

**Name of the Vulnerable Software and Affected Versions** cups-filters (affected versions not specified) **Description** The issue is related to the Backend Error Handler (beh) component of the cups-filters package, which does not properly sanitize special elements used in operating system commands. This can be exploited by a remote attacker to execute arbitrary commands on the print server by sending a specially crafted print job. The `beh.c` file contains a line that calls the `system` command with the operand `cmdline`, which includes multiple user-controlled, unsanitized values. As a result, an attacker with network access to the hosted print server can inject system commands that are executed in the context of the running server. **Recommendations** To resolve the issue, users are advised to upgrade to the next release when possible. In the meantime, it is recommended to restrict access to network printers. Additionally, as a temporary workaround, consider disabling the `beh` component until a patch is available. Restrict access to the `beh.c` file to minimize the risk of exploitation. Avoid using the `cmdline` variable in the affected `system` command until the issue is resolved.

**Nome do software vulnerável e versões afetadas** Versões do Tasmota anteriores ao commit 066878da4d4762a9b6cb169fdf353e804d735cfd **Descrição** Foi detectada uma falha de estouro de pilha por meio do parâmetro `ClientPortPtr` em lib/libesp32/rtsp/CRtspSession.cpp. **Recomendações** Para versões anteriores ao commit 066878da4d4762a9b6cb169fdf353e804d735cfd, considere atualizar para uma versão que inclua a correção para este problema. Como solução temporária, considere restringir o acesso à função `CRtspSession.cpp` até que um patch esteja disponível. Evite usar o parâmetro `ClientPortPtr` na sessão rtsp afetada até que o problema seja resolvido.