Arthur Chan

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

**Name of the Vulnerable Software and Affected Versions** OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 erts versions 6.0 through 15.2.7.12 erts versions 16.0 through 16.4.0.5 erts versions 17.0 through 17.0.5 **Description** An attacker connecting to an open Erlang TCP port using the inet driver with `{packet,4}` mode can trigger a signed overflow due to an incorrect packet length calculation. This allows the receive buffer to overflow into the VM allocator area and beyond by up to 2 GB, which typically corrupts the allocator metadata footer and subsequent blocks, leading to a BEAM VM crash. Achieving Remote Code Execution through this method is considered extremely unfeasible. **Recommendations** Update OTP to version 27.3.4.17 or later. Update OTP to version 28.5.0.6 or later. Update OTP to version 29.0.6 or later. Update erts to version 15.2.7.13 or later. Update erts to version 16.4.0.6 or later. Update erts to version 17.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** LibreOffice (affected versions not specified) **Description** A stack buffer overflow occurs when importing presentations in the legacy binary PPT format. The issue arises during the import of a colour-replacement record where two fixed-size colour tables are filled from the file. Because the write position is not reset between the two passes over the record, a file with combined colour counts exceeding the table size writes past the end of the tables on the stack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LibreOffice Calc (affected versions not specified) **Description** A heap buffer overflow occurs during the compilation of cell formulas when opening a spreadsheet. This issue is triggered by very long formulas containing numerous opening tokens. The array used to track nesting depth is allocated with one element too few for the worst-case scenario, causing the formula to write one element beyond the array boundary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LibreOffice Calc (affected versions not specified) **Description** A heap buffer overflow occurs during the import of tracked changes from a spreadsheet document. This happens when a document reuses the same change identifier for two different types of changes, causing the importer to treat a change object as a larger type and write data beyond the allocated memory boundary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cloud Foundry UAA versions v76.12.0 through v78.12.0 CF Deployment versions v30.0.0 through v56.0.0 **Description** Private key exposure occurs when the server inadvertently reveals Elliptic Curve (EC) private keys through the public '/token keys' endpoint. While this endpoint is intended to provide public key material for JSON Web Token (JWT) verification, it incorrectly exposes private key components for EC keys. This issue specifically affects deployments using EC keys for JWT token signing and does not impact RSA key configurations. **Recommendations** Update uaa release to version v78.13.0 or later. Update CF Deployment to version v56.1.0 or later. Rotate EC keys used for JWT token signing. As a temporary mitigation, disable the use of EC keys for JWT signing.