Charles Fol

**Name of the Vulnerable Software and Affected Versions** WatchGuard Firebox and XTM appliances versions prior to 12.1.4 WatchGuard Firebox and XTM appliances versions prior to 12.5.10 WatchGuard Firebox and XTM appliances versions prior to 12.8.1 **Description** A local attacker with shell access can elevate privileges and execute code with root permissions. **Recommendations** For versions prior to 12.1.4, update to Fireware OS 12.1.4 or later. For versions prior to 12.5.10, update to Fireware OS 12.5.10 or later. For versions prior to 12.8.1, update to Fireware OS 12.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Firebox and XTM appliances versions prior to 12.1.4 WatchGuard Firebox and XTM appliances versions prior to 12.5.10 WatchGuard Firebox and XTM appliances versions prior to 12.8.1 **Description** An integer overflow allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports. **Recommendations** For versions prior to 12.1.4, update to Fireware OS 12.1.4 or later. For versions prior to 12.5.10, update to Fireware OS 12.5.10 or later. For versions prior to 12.8.1, update to Fireware OS 12.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Firebox and XTM appliances versions prior to 12.1.4 WatchGuard Firebox and XTM appliances versions prior to 12.5.10 WatchGuard Firebox and XTM appliances versions prior to 12.8.1 **Description** The issue allows an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. **Recommendations** For versions prior to 12.1.4, update to Fireware OS 12.1.4 or later. For versions prior to 12.5.10, update to Fireware OS 12.5.10 or later. For versions prior to 12.8.1, update to Fireware OS 12.8.1 or later.

The software that is vulnerable is the GNU C Library (glibc) versions 2.39 and older, specifically the iconv() function when converting strings to the ISO-2022-CN-EXT character set. This vulnerability can be exploited through PHP-based web applications. The vulnerability is a buffer overflow in the iconv() function, which can be used to crash an application or overwrite a neighboring variable, potentially allowing remote code execution (RCE). The vulnerability is identified as CVE-2024-2961. There is a public exploit available for this vulnerability, and it has been demonstrated that it can be used to achieve RCE on PHP-based web applications, including Roundcube. The vulnerability can be exploited by sending a specially crafted string to the iconv() function, which can cause a buffer overflow and allow an attacker to execute arbitrary code. It is recommended that users upgrade their glibc library to a version that is not vulnerable to this exploit. Some Linux distributions, such as Rocky Linux, have already released patches for this vulnerability. The number of Internet users that can be affected by the exploitation of this vulnerability is not specified, but it is likely that many PHP-based web applications are vulnerable, as glibc is a widely used library. #CVE-2024-2961 #glibc #iconv #bufferoverflow #RCE #PHP #vulnerability #exploit #Linux #Roundcube #GNUCLibrary

**Name of the Vulnerable Software and Affected Versions** PHP versions 7.4.x through 7.4.29 PHP versions 8.0.x through 8.0.19 PHP versions 8.1.x through 8.1.6 **Description** The issue is related to the `pg query params()` function in PHP's Postgres database extension, where supplying invalid parameters to a parametrized query may cause PHP to attempt to free memory using uninitialized data as pointers. This could lead to remote code execution or denial of service. The vulnerability can be exploited by a remote attacker, potentially allowing them to execute arbitrary code. **Recommendations** For PHP versions 7.4.x through 7.4.29, update to version 7.4.30 or later. For PHP versions 8.0.x through 8.0.19, update to version 8.0.20 or later. For PHP versions 8.1.x through 8.1.6, update to version 8.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 2.5.3 **Description** The issue allows for Admin Account Creation. **Recommendations** For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** PHP versions 7.4.x through 7.4.29 PHP versions 8.0.x through 8.0.19 PHP versions 8.1.x through 8.1.6 **Description** The issue is related to a buffer overflow vulnerability in the mysqlnd/pdo function of the PHP interpreter, specifically in the mysqlnd wireprotocol.c file. This vulnerability can be exploited by a remote attacker to execute arbitrary code. The vulnerability occurs when a third-party supplier is allowed to provide the host to connect to and the password for the connection, and an excessively long password can trigger the buffer overflow. **Recommendations** For PHP versions 7.4.x through 7.4.29, update to version 7.4.30 or later. For PHP versions 8.0.x through 8.0.19, update to version 8.0.20 or later. For PHP versions 8.1.x through 8.1.6, update to version 8.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** The GD Graphics Library versions 2.2.5 and earlier PHP versions prior to 5.6.40 PHP versions 7.x prior to 7.1.26 PHP versions 7.2.x prior to 7.2.14 PHP versions 7.3.x prior to 7.3.1 **Description** The issue is caused by a heap-based buffer overflow in the `gdImageColorMatch` function of the GD Graphics Library. This can be exploited by a remote attacker who can trigger `imagecolormatch` calls with specially crafted image data, potentially allowing the attacker to initiate malicious actions. **Recommendations** For The GD Graphics Library version 2.2.5, update to a version later than 2.2.5. For PHP version 5.6.x, update to version 5.6.40 or later. For PHP version 7.x, update to version 7.1.26 or later. For PHP version 7.2.x, update to version 7.2.14 or later. For PHP version 7.3.x, update to version 7.3.1 or later. As a temporary workaround, consider restricting the use of the `imagecolormatch` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PrestaShop versions prior to 1.6.1.20 PrestaShop versions 1.7.x prior to 1.7.3.4 **Description** The issue concerns the mishandling of cookie encryption in certain PHP files, specifically Cookie.php, Rinjdael.php, and Blowfish.php. **Recommendations** For PrestaShop versions prior to 1.6.1.20, update to version 1.6.1.20 or later. For PrestaShop versions 1.7.x prior to 1.7.3.4, update to version 1.7.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** zKup CMS versions 2.0 through 2.3 **Description** The issue allows remote attackers to gain administrator privileges without requiring administrative authentication for the admin/configuration/modifier.php endpoint. This can be achieved by making a direct request to this endpoint, for example, by adding a new administrator. **Recommendations** For zKup CMS versions 2.0 through 2.3, consider restricting access to the admin/configuration/modifier.php endpoint until a proper fix is available. As a temporary workaround, limit the ability to add new administrators to prevent unauthorized access.

Name of the Vulnerable Software and Affected Versions: fuzzylime (cms) versions prior to 3.01b Description: The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a `files` array element for a `blogs` action. This can be demonstrated by manipulating the `files[0]` parameter. Recommendations: For versions prior to 3.01b, update to version 3.01b or later to resolve the issue. As a temporary workaround, consider restricting access to the `commsrss.php` file to minimize the risk of exploitation. Avoid using the `files` array element in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PEEL versions 3.x and earlier **Description** The issue allows remote attackers to gain administrative access due to default accounts with known passwords. Specifically, it has a default info@peel.fr account with password `admin`, and a default contact@peel.fr account with password `cinema`. **Recommendations** For versions 3.x and earlier, change the default passwords for the info@peel.fr and contact@peel.fr accounts to secure passwords. As a temporary workaround, consider disabling these default accounts until a more permanent solution is available.