Brian M. Carlson

**Name of the Vulnerable Software and Affected Versions** Go versions prior to 1.17.11 Go versions prior to 1.18.3 **Description** The issue allows for code injection in Cmd.Start in os/exec, enabling the execution of any binaries in the working directory named either "..com" or "..exe" by calling `Cmd.Run`, `Cmd.Start`, `Cmd.Output`, or `Cmd.CombinedOutput` when `Cmd.Path` is unset. This occurs on Windows. **Recommendations** For Go versions prior to 1.17.11, update to Go 1.17.11 or later to resolve the issue. For Go versions prior to 1.18.3, update to Go 1.18.3 or later to resolve the issue. As a temporary workaround, consider setting `Cmd.Path` to a specific executable to avoid unintentional execution of binaries in the working directory.

**Name of the Vulnerable Software and Affected Versions** Acon versions 1.0.5-5 through 1.0.5-7 **Description** The issue is related to multiple stack-based buffer overflows in files acon.c, menu.c, and child.c. This allows local users to execute arbitrary code via a long HOME environment variable or a large number of terminal columns. **Recommendations** For versions 1.0.5-5 through 1.0.5-7, consider restricting access to the affected files acon.c, menu.c, and child.c to minimize the risk of exploitation. As a temporary workaround, limit the length of the HOME environment variable and the number of terminal columns to prevent buffer overflows. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** a2ps versions 4.14 **Description** The issue concerns multiple vulnerabilities in the a2ps package of the Debian GNU/Linux operating system, which can be exploited to compromise the confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be performed remotely. Specifically, the fixps script in a2ps does not use the -dSAFER option when executing gs, allowing context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file. **Recommendations** For a2ps version 4.14, consider disabling the fixps script until a patch is available to prevent potential exploitation. Restrict access to the gs execution to minimize the risk of arbitrary file deletion or command execution. Avoid using crafted PostScript files in the affected a2ps version until the issue is resolved.