Xpl017Elz

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3 and earlier Description: The issue is a stack-based buffer overflow in the Apache Connector (mod wl) that allows remote attackers to execute arbitrary code via a long HTTP version string. This can be demonstrated by a string after "POST /.jsp" in an HTTP request. Recommendations: For Oracle WebLogic Server versions 10.3 and earlier, consider updating to a version that is not affected by this issue. As a temporary workaround, restrict access to the Apache Connector (mod wl) to minimize the risk of exploitation.

The issue allows local users to execute arbitrary code by modifying the PATH environment variable to reference a malicious smbpasswd program. This is due to an untrusted search path vulnerability.

Name of the Vulnerable Software and Affected Versions: WsMp3d version 0.0.10 and earlier Description: The issue is related to multiple heap-based buffer overflows that allow remote attackers to execute arbitrary code via long HTTP requests. Recommendations: For WsMp3d version 0.0.10 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.