Dan Kaminsky

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.1 ext4dev-kmp-trace (affected versions not specified) **Description** The issue concerns the Linux kernel's IPv4 and IPv6 implementations, which use a modified MD4 algorithm. This makes it easier for remote attackers to disrupt networking or hijack network sessions by predicting sequence numbers and Fragment Identification values and sending crafted packets. Additionally, multiple vulnerabilities in the ext4dev-kmp-trace package of SUSE Linux Enterprise may lead to a disruption of protected information availability, exploitable remotely. **Recommendations** For Linux kernel versions prior to 3.1, update to version 3.1 or later to resolve the issue. For ext4dev-kmp-trace, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xiph.Org Theora versions prior to 1.1 Mozilla Firefox versions prior to 3.5.6 SeaMonkey versions prior to 2.0.1 **Description** The issue is caused by an integer overflow in the libtheora component. This can be triggered by a video with large dimensions, potentially leading to a denial of service (application crash) or possibly allowing the execution of arbitrary code. **Recommendations** For Xiph.Org Theora versions prior to 1.1, update to version 1.1 or later. For Mozilla Firefox versions prior to 3.5.6, update to version 3.5.6 or later. For SeaMonkey versions prior to 2.0.1, update to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** A spoofing issue exists in the CryptoAPI component when handling X.509 certificates. This issue allows man-in-the-middle attackers to impersonate arbitrary SSL servers via a crafted certificate. The problem arises from the improper handling of a '0' character in a domain name in the subject's Common Name field of an X.509 certificate. **Recommendations** For Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** The issue is related to an integer overflow in the CryptoAPI component when parsing X.509 certificates with malformed ASN.1 Object Identifiers. This allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities via a certificate issued by a legitimate Certification Authority. An attacker could impersonate another user or system by exploiting this vulnerability. **Recommendations** For Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, update to a version that includes the fix for the integer overflow in the CryptoAPI component. As a temporary workaround, consider restricting the use of X.509 certificates with ASN.1 object identifiers to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.14 Description: The issue is related to the improper implementation of certain dialogs associated with the `pkcs11.addmodule` and `pkcs11.deletemodule` operations. This makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module. Recommendations: For versions prior to 3.0.14, update to version 3.0.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Network Security Services (NSS) versions prior to 3.12.3 Firefox versions prior to 3.0.13 Thunderbird versions prior to 2.0.0.23 SeaMonkey versions prior to 1.1.18 **Description** The issue arises from improper handling of a '0' character in a domain name within the subject's Common Name (CN) field of an X.509 certificate. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. **Recommendations** For Mozilla Network Security Services (NSS) versions prior to 3.12.3, update to version 3.12.3 or later. For Firefox versions prior to 3.0.13, update to version 3.0.13 or later. For Thunderbird versions prior to 2.0.0.23, update to version 2.0.0.23 or later. For SeaMonkey versions prior to 1.1.18, update to version 1.1.18 or later.

**Name of the Vulnerable Software and Affected Versions** libspf2 versions prior to 1.2.8 **Description** The issue is related to a heap-based buffer overflow in the SPF dns resolv lookup function in Spf dns resolv.c. This allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field. The vulnerability can be exploited remotely and may lead to disruption of confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the SPF dns resolv lookup function until a patch is available. Avoid using long DNS TXT records with modified length fields in the affected function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** libvorbisfile3 (affected versions not specified) libvorbis0a (affected versions not specified) libvorbis-dev (affected versions not specified) libvorbisenc2 (affected versions not specified) Mozilla Firefox versions prior to 3.5.4 **Description** The issue involves multiple unspecified vulnerabilities in the libvorbis package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code. The estimated number of potentially affected devices worldwide is not available. **Recommendations** For libvorbisfile3, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvorbis0a, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvorbis-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvorbisenc2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Mozilla Firefox, update to version 3.5.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Network Security Services (NSS) library versions prior to 3.12.3 GnuTLS versions prior to 2.6.4 and 2.7.4 OpenSSL versions 0.9.8 through 0.9.8k **Description** The issue allows remote attackers to potentially spoof certificates by exploiting MD2 design flaws to generate a hash collision in less than brute-force time. This could lead to violations of confidentiality, integrity, and availability of protected information. The scope of this issue is currently limited due to the large amount of computation required. **Recommendations** For Network Security Services (NSS) library versions prior to 3.12.3, update to version 3.12.3 or later. For GnuTLS versions prior to 2.6.4 and 2.7.4, update to version 2.6.4 or 2.7.4 or later. For OpenSSL versions 0.9.8 through 0.9.8k, update to version 0.9.8l or later. As a temporary workaround, consider restricting the use of MD2 with X.509 certificates until a patch is available.