Gregor Kopf

**Name of the Vulnerable Software and Affected Versions** Libreoffice (affected versions not specified) hsqldb version 1.8.0 **Description** A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a `SCRIPT` command where the contents of the file could be written to a new file whose location was determined by the attacker. **Recommendations** For Libreoffice, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For hsqldb version 1.8.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** F*EX (aka Frams' Fast File EXchange) versions prior to fex-20160919 2 **Description** The issue allows for eval injection, which can be used for unauthenticated remote code execution. **Recommendations** For versions prior to fex-20160919 2, update to a version equal to or later than fex-20160919 2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier **Description** The issue allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem through the User.getLanguage method. This can be exploited by unauthenticated attackers with access to the web interface. **Recommendations** For versions 2.29.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eQ-3 AG HomeMatic CCU2 version 2.29.22 **Description** The issue allows exploitation by sending arbitrary XML-RPC requests to control attached BidCos devices, due to an open XML-RPC port without authentication. **Recommendations** For version 2.29.22, consider restricting access to the XML-RPC port to minimize the risk of exploitation. As a temporary workaround, limit control of the attached BidCos devices until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier **Description** The issue allows authenticated attackers to perform Remote Code Execution in the addon installation process. This enables them to create or overwrite arbitrary files or install malicious software on the device. **Recommendations** For versions 2.29.2 and earlier, update to a version later than 2.29.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** eQ-3 AG HomeMatic CCU2 version 2.29.22 **Description** The issue concerns the download of software update packages via the HTTP protocol, which lacks cryptographic protection. An attacker with a privileged network position can exploit this to provide malicious firmware updates, potentially resulting in a full system compromise. **Recommendations** For eQ-3 AG HomeMatic CCU2 version 2.29.22, consider disabling the `loopupd.sh` script in `/usr/local/etc/config/addons/mh/` as a temporary workaround until a patch is available. Restrict access to the device to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier **Description** The issue is related to a Remote Code Execution vulnerability in the TCL script interpreter. This allows remote attackers to obtain read/write access and execute system commands on the device. The vulnerability can be exploited by unauthenticated attackers with access to the web interface. It is associated with shortcomings in the security mechanisms of the TCL script interpreter, enabling remote attackers to read and write arbitrary files and execute system commands on the device using the web interface. **Recommendations** For versions 2.29.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier **Description** The issue is related to a method called `User.setLanguage` and is associated with security mechanism weaknesses. This allows remote attackers to write arbitrary files to the device's filesystem and potentially execute arbitrary code on the device using the web interface. The vulnerability can be exploited by unauthenticated attackers with access to the web interface. **Recommendations** For versions 2.29.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12 **Description** The issue is related to a sandbox escape in the libxpc component, specifically with the launchctl process, due to insufficient access control. This could allow a local attacker to elevate their privileges. **Recommendations** For macOS versions prior to 10.12, update to version 10.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FortiOS versions prior to 4.3.16 FortiOS versions 5.x prior to 5.0.8 **Description** The issue is related to the FortiManager protocol service in Fortinet FortiOS, which does not prevent the use of anonymous ciphersuites. This makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream. The vulnerability can be exploited by a remote attacker to perform a man-in-the-middle attack, gain access to protected information, and redirect network traffic. **Recommendations** For FortiOS versions prior to 4.3.16, update to version 4.3.16 or later. For FortiOS versions 5.x prior to 5.0.8, update to version 5.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Logsurfer+ versions prior to 1.8 Logsurfer version 1.5b and earlier Logsurfer+ version 1.7 and earlier **Description** The issue concerns a double free vulnerability in the prepare exec function, which can be exploited remotely. This vulnerability may lead to a breach of confidentiality, integrity, and availability of protected information. It allows remote attackers to execute arbitrary commands via crafted strings in a log file. **Recommendations** For Logsurfer+ versions prior to 1.8, update to version 1.8 or later. For Logsurfer version 1.5b and earlier, update to a version later than 1.5b. For Logsurfer+ version 1.7 and earlier, update to a version later than 1.7. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 4.2.10 Apple iOS versions 4.3.x prior to 4.3.5 **Description** The issue concerns the Data Security component's failure to check the basicConstraints parameter during the validation of X.509 certificate chains. This allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain. **Recommendations** For Apple iOS versions prior to 4.2.10, update to version 4.2.10 or later. For Apple iOS versions 4.3.x prior to 4.3.5, update to version 4.3.5 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.2.x through 4.2.14 TYPO3 versions 4.3.x through 4.3.6 TYPO3 versions 4.4.x through 4.4.3 **Description** The issue allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter. **Recommendations** For versions 4.2.x through 4.2.14, update to version 4.2.15 or later. For versions 4.3.x through 4.3.6, update to version 4.3.7 or later. For versions 4.4.x through 4.4.3, update to version 4.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.2.x through 4.2.14 TYPO3 versions 4.3.x through 4.3.6 TYPO3 versions 4.4.x through 4.4.3 **Description** The issue is related to the jumpUrl implementation in tslib/class.tslib fe.php, which does not properly compare certain hash values during access-control decisions. This allows remote attackers to read arbitrary files via unspecified vectors. The vulnerability can be exploited remotely and may lead to a breach of confidentiality of protected information. **Recommendations** For TYPO3 versions 4.2.x through 4.2.14, update to version 4.2.15 or later. For TYPO3 versions 4.3.x through 4.3.6, update to version 4.3.7 or later. For TYPO3 versions 4.4.x through 4.4.3, update to version 4.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.2.x through 4.2.14 TYPO3 versions 4.3.x through 4.3.6 TYPO3 versions 4.4.x through 4.4.3 **Description** The issue concerns multiple vulnerabilities in the TYPO3 package that can lead to a breach of protected information. These vulnerabilities can be exploited remotely. A specific function, `t3lib div::validEmail`, does not properly restrict input, allowing remote attackers to cause a denial of service by consuming memory and crashing the application via a long email address string. **Recommendations** For TYPO3 versions 4.2.x through 4.2.14, update to version 4.2.15 or later. For TYPO3 versions 4.3.x through 4.3.6, update to version 4.3.7 or later. For TYPO3 versions 4.4.x through 4.4.3, update to version 4.4.4 or later. As a temporary workaround, consider restricting input to the `t3lib div::validEmail` function to prevent denial of service attacks.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.2.x through 4.2.14 TYPO3 versions 4.3.x through 4.3.6 **Description** The issue allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships. Multiple vulnerabilities in the TYPO3 package may lead to a breach of protected information, and exploitation can be done remotely. **Recommendations** For TYPO3 versions 4.2.x through 4.2.14, update to version 4.2.15 or later. For TYPO3 versions 4.3.x through 4.3.6, update to version 4.3.7 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.2.x through 4.2.14 TYPO3 versions 4.3.x through 4.3.6 TYPO3 versions 4.4.x through 4.4.3 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to the RemoveXSS function, and allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the backend. This can lead to a breach of protected information. The exploitation of the vulnerabilities can be carried out remotely. **Recommendations** For versions 4.2.x through 4.2.14, update to version 4.2.15 or later. For versions 4.3.x through 4.3.6, update to version 4.3.7 or later. For versions 4.4.x through 4.4.3, update to version 4.4.4 or later.