Eduardo Vela

A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host.

A buffer overflow was discovered in NTFS-3G, which can be exploited by crafted metadata in an NTFS image, leading to code execution. This can be exploited by a local attacker if the ntfs-3g binary is setuid root, or by a physically proximate attacker if NTFS-3G software is configured to execute upon attachment of an external storage device. The issue is related to errors in processing metadata, allowing an attacker to execute arbitrary code.

The issue is related to an integer overflow in the `xml utf8 decode` function, which can be exploited by remote attackers using a crafted string with overlong UTF-8 encoding. This allows attackers to bypass protection mechanisms against cross-site scripting (XSS) and SQL injection.

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 9.0.124.0 and earlier Description: The issue allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements. This can be used to hijack the camera or microphone and is related to "clickjacking." Recommendations: For Adobe Flash Player versions 9.0.124.0 and earlier, update to a version later than 9.0.124.0 to resolve the issue.

A cross-domain issue allows remote attackers to change the location property of a frame via the Object data type. This can be used to observe domain-independent events, such as onkeydown events, using a frame from a different domain.

A cross-domain issue allows remote attackers to change the location property of a frame via the String data type. This can be used to observe domain-independent events, such as onkeydown events, using a frame from a different domain.