Eduardo Vela

**Name of the Vulnerable Software and Affected Versions** Intel Processors (affected versions not specified) **Description** A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NTFS-3G versions prior to 2022.10.3 **Description** A buffer overflow was discovered in NTFS-3G, which can be exploited by crafted metadata in an NTFS image, leading to code execution. This can be exploited by a local attacker if the ntfs-3g binary is setuid root, or by a physically proximate attacker if NTFS-3G software is configured to execute upon attachment of an external storage device. The issue is related to errors in processing metadata, allowing an attacker to execute arbitrary code. **Recommendations** For NTFS-3G versions prior to 2022.10.3, update to version 2022.10.3 or later to resolve the issue. As a temporary workaround, consider disabling the execution of NTFS-3G upon attachment of an external storage device and removing setuid root permissions from the ntfs-3g binary to minimize the risk of exploitation. Restrict access to the ntfs-3g utility to prevent potential attacks.

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.2.11 **Description** The issue is related to an integer overflow in the `xml utf8 decode` function, which can be exploited by remote attackers using a crafted string with overlong UTF-8 encoding. This allows attackers to bypass protection mechanisms against cross-site scripting (XSS) and SQL injection. **Recommendations** For PHP versions prior to 5.2.11, update to version 5.2.11 or later to resolve the issue. As a temporary workaround, consider restricting input to prevent the use of overlong UTF-8 encoding.

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 9.0.124.0 and earlier Description: The issue allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements. This can be used to hijack the camera or microphone and is related to "clickjacking." Recommendations: For Adobe Flash Player versions 9.0.124.0 and earlier, update to a version later than 9.0.124.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 7 through 8 **Description** A cross-domain issue allows remote attackers to change the location property of a frame via the Object data type. This can be used to observe domain-independent events, such as onkeydown events, using a frame from a different domain. **Recommendations** For Microsoft Internet Explorer versions 7 and 8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 6 through 7 **Description** A cross-domain issue allows remote attackers to change the location property of a frame via the String data type. This can be used to observe domain-independent events, such as onkeydown events, using a frame from a different domain. **Recommendations** For Microsoft Internet Explorer versions 6 through 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.