Bruce Chen

An integer underflow and out-of-bounds heap read exist in the TCP urgent data handling (sosendoob) within hypervisor host environments, such as QEMU. A privileged attacker in a guest VM (possessing root or `CAP NET RAW` privileges) can leak significant amounts of sensitive host-process heap memory by sending crafted TCP segments with manipulated URG flags and urgent pointers `ti urp`. Real-world incidents have demonstrated that this issue can be chained to achieve arbitrary read and write access on the host.

A flaw exists in Microsoft SharePoint Server that enables remote attackers to execute arbitrary code and compromise the system. The issue stems from insufficient input validation. Exploitation of this flaw could allow an attacker to execute code remotely by using specially crafted data. This is a post-authentication remote code execution issue.