Giwan Go

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 4.9.6 and earlier, 5.x versions prior to 5.0.3 Description: The issue is related to the transformation feature in phpMyAdmin, which allows for cross-site scripting (XSS) attacks via a crafted link. This can enable a remote attacker to perform cross-site scripting attacks. The vulnerability is due to the lack of protection of the web page structure. Recommendations: For phpMyAdmin versions 4.9.6 and earlier, update to version 4.9.6 or later. For 5.x versions prior to 5.0.3, update to version 5.0.3 or later. As a temporary workaround, consider disabling the transformation feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Hancom NEO versions 9.6.1.5183 and earlier **Description** The issue allows remote attackers to execute arbitrary commands when performing hyperlink attributes in a document, due to a buffer overflow. **Recommendations** For Hancom NEO versions 9.6.1.5183 and earlier, update to a version later than 9.6.1.5183 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader versions 11.0.19 and earlier Adobe Acrobat Reader versions 15.006.30280 and earlier Adobe Acrobat Reader versions 15.023.20070 and earlier **Description** The issue is related to a buffer overflow and memory leak when parsing code, potentially allowing a remote attacker to compromise information confidentiality. It involves a memory address leak vulnerability in the JPEG 2000 parser, related to contiguous code-stream parsing. A memory corruption issue allows attackers to cause a memory leak. **Recommendations** For Adobe Acrobat Reader version 11.0.19 and earlier, update to a version later than 11.0.19 to resolve the issue. For Adobe Acrobat Reader version 15.006.30280 and earlier, update to a version later than 15.006.30280 to resolve the issue. For Adobe Acrobat Reader version 15.023.20070 and earlier, update to a version later than 15.023.20070 to resolve the issue. As a temporary workaround, consider restricting the use of the JPEG 2000 parser in Adobe Acrobat Reader until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader versions 11.0.19 and earlier Adobe Acrobat Reader versions 15.006.30280 and earlier Adobe Acrobat Reader versions 15.023.20070 and earlier **Description** The issue is related to a memory corruption vulnerability in the JPEG 2000 engine, specifically tied to image scaling. This can lead to arbitrary code execution when exploited. The vulnerability can be exploited by a remote attacker, potentially resulting in damage to memory. **Recommendations** For Adobe Acrobat Reader version 11.0.19 and earlier, update to a version later than 11.0.19 to resolve the issue. For Adobe Acrobat Reader version 15.006.30280 and earlier, update to a version later than 15.006.30280 to resolve the issue. For Adobe Acrobat Reader version 15.023.20070 and earlier, update to a version later than 15.023.20070 to resolve the issue. As a temporary workaround, consider disabling the JPEG 2000 engine in Adobe Acrobat Reader until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT 8.1 Microsoft Windows 10 versions Gold, 1511, and 1607 Microsoft Windows Server 2016 **Description** The issue allows remote attackers to execute arbitrary code via a crafted web site. This can affect the system, enabling remote code execution. **Recommendations** For Microsoft Windows Vista SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 8.1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Microsoft Windows RT 8.1, update to a newer version to mitigate the risk. For Microsoft Windows 10 versions Gold, 1511, and 1607, update to a newer version to mitigate the risk. For Microsoft Windows Server 2016, update to a newer version to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 55.0.2883.75 for Mac, Windows and Linux Google Chrome version prior to 55.0.2883.84 for Android **Description** The issue is related to bad casting in bitmap manipulation in the Blink component of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue by using a specially crafted HTML page. This could allow the attacker to access protected information. **Recommendations** For Google Chrome versions prior to 55.0.2883.75 for Mac, Windows and Linux, update to version 55.0.2883.75 or later. For Google Chrome version prior to 55.0.2883.84 for Android, update to version 55.0.2883.84 or later. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 53.0.2785.89 on Windows and OS X Google Chrome versions prior to 53.0.2785.92 on Linux **Description** The issue is related to multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome. This allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during `opj aligned malloc` calls in dwt.c and t1.c. **Recommendations** For Google Chrome versions prior to 53.0.2785.89 on Windows and OS X, update to version 53.0.2785.89 or later. For Google Chrome versions prior to 53.0.2785.92 on Linux, update to version 53.0.2785.92 or later. As a temporary workaround, consider restricting the handling of JPEG 2000 data in affected systems until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenJPEG versions prior to 53.0.2785.89 Google Chrome versions prior to 53.0.2785.89 on Windows and OS X Google Chrome versions prior to 53.0.2785.92 on Linux Opera versions prior to 53.0.2785.89 **Description** The issue is related to an integer overflow in the `opj tcd get decoded tile size` function in `tcd.c` in OpenJPEG. This can be exploited by remote attackers using crafted JPEG 2000 data, potentially leading to a denial of service (heap-based buffer overflow) or other unspecified impacts. **Recommendations** For OpenJPEG, update to a version that fixes the integer overflow in the `opj tcd get decoded tile size` function. For Google Chrome on Windows and OS X, update to version 53.0.2785.89 or later. For Google Chrome on Linux, update to version 53.0.2785.92 or later. For Opera, update to a version that includes the fix for the integer overflow in OpenJPEG. As a temporary workaround, consider restricting the use of crafted JPEG 2000 data until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenJPEG versions prior to 52.0.2743.116 Google Chrome versions prior to 52.0.2743.116 Opera versions prior to 52.0.2743.116 **Description** The issue is caused by multiple integer overflows in the `opj tcd init tile` function in `tcd.c` in OpenJPEG, which is used in PDFium in Google Chrome and Opera. This allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. **Recommendations** For OpenJPEG versions prior to 52.0.2743.116, update to version 52.0.2743.116 or later. For Google Chrome versions prior to 52.0.2743.116, update to version 52.0.2743.116 or later. For Opera versions prior to 52.0.2743.116, update to version 52.0.2743.116 or later. As a temporary workaround, consider disabling the `opj tcd init tile` function in `tcd.c` until a patch is available.