Xpl017Elz

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3 and earlier Description: The issue is a stack-based buffer overflow in the Apache Connector (mod wl) that allows remote attackers to execute arbitrary code via a long HTTP version string. This can be demonstrated by a string after "POST /.jsp" in an HTTP request. Recommendations: For Oracle WebLogic Server versions 10.3 and earlier, consider updating to a version that is not affected by this issue. As a temporary workaround, restrict access to the Apache Connector (mod wl) to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Qualcomm qpopper versions 4.0 through 4.05 **Description** The issue allows local users to execute arbitrary code by modifying the PATH environment variable to reference a malicious smbpasswd program. This is due to an untrusted search path vulnerability. **Recommendations** For versions 4.0 through 4.05, consider restricting access to the PATH environment variable to prevent modification and minimize the risk of exploitation. As a temporary workaround, avoid using the smbpasswd program until a patch is available.

Name of the Vulnerable Software and Affected Versions: WsMp3d version 0.0.10 and earlier Description: The issue is related to multiple heap-based buffer overflows that allow remote attackers to execute arbitrary code via long HTTP requests. Recommendations: For WsMp3d version 0.0.10 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.