Carnilo

**Name of the Vulnerable Software and Affected Versions** Ghostscript GhostPDL versions 9.50 through 9.53.3 **Description** The issue is related to a use-after-free in the `sampled data sample` function, which can be called from `sampled data continue` and `interp`. This can potentially allow an attacker to cause a denial of service. **Recommendations** For Ghostscript GhostPDL versions 9.50 through 9.53.3, consider disabling the `sampled data sample` function as a temporary workaround until a patch is available. Restrict access to the `interp` and `sampled data continue` functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libarchive version 3.3.2 Description: The issue is related to an out-of-bounds read within the `lha read data none()` function in `archive read support format lha.c` when extracting a specially crafted lha archive. This is connected to `lha crc16`. Exploitation of the issue may allow a remote attacker to gain unauthorized access to information using a specially created lha archive. Recommendations: For libarchive version 3.3.2, as a temporary workaround, consider disabling the `lha read data none()` function until a patch is available. Restrict access to the `archive read support format lha.c` module to minimize the risk of exploitation. Avoid using the `lha crc16` variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libarchive version 3.3.2 Description: The issue is related to an out-of-bounds read flaw in the `archive read format iso9660 read header` function in `archive read support format iso9660.c` of the libarchive library. This flaw can be exploited by a remote attacker using a specially crafted iso9660 file to gain unauthorized access to information. The vulnerability is also related to the `parse file info` function. Recommendations: For libarchive version 3.3.2, consider updating to a newer version that contains a fix for this issue, as using a specially crafted iso9660 file can lead to exploitation. As a temporary workaround, consider restricting the use of the `archive read format iso9660 read header` function and the `parse file info` function in `archive read support format iso9660.c` until a patch is available. Avoid using libarchive to extract specially crafted iso9660 files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Capture::Tiny versions prior to 0.24 **Description** The issue allows local users to write to arbitrary files via a symlink attack on a temporary file. This is related to the Capture::Tiny module for Perl. **Recommendations** For versions prior to 0.24, update to version 0.24 or later to resolve the issue. As a temporary workaround, consider restricting access to temporary files used by the Capture::Tiny module to minimize the risk of exploitation.