Luis Merino

**Name of the Vulnerable Software and Affected Versions** YARA versions prior to 4.0.4 **Description** The issue is related to an integer overflow and several buffer overflow reads in the libyara/modules/macho/macho.c module of YARA. This could allow an attacker to cause denial of service or information disclosure via a malicious Mach-O file. The exploitation of this issue may enable a remote attacker to access confidential data and cause service disruption. **Recommendations** For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `macho.c` module until a patch is available. Avoid processing malicious or untrusted Mach-O files with affected versions of YARA to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** bsdiff tools version 4.3 **Description** A memory corruption issue is present due to insufficient checks when handling external inputs, allowing an attacker to bypass sanity checks and write out of a dynamically allocated buffer's boundaries. **Recommendations** For version 4.3, consider updating to a newer version that addresses this issue, as the current version allows for memory corruption due to insufficient input checks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 60.7.1 **Description** A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in `icalrecur add bydayrules` when processing certain email messages, resulting in a potentially exploitable crash. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Thunderbird versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of email messages that may trigger the `icalrecur add bydayrules` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 60.7.1 **Description** A flaw in Thunderbird's implementation of iCal causes a type confusion in `icaltimezone get vtimezone properties` when processing certain email messages, resulting in a crash. The vulnerability is related to a lack of type checking of the passed object, which can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Thunderbird versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider avoiding the processing of suspicious email messages that may trigger the type confusion in `icaltimezone get vtimezone properties`.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 60.7.1 **Description** A flaw in the implementation of iCal in Thunderbird causes a heap buffer overflow in `parser get next char` when processing certain email messages, resulting in a potentially exploitable crash. This issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For Thunderbird versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of certain email messages that may trigger the heap buffer overflow in `parser get next char` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 60.7.1 **Description** The issue is related to a heap buffer overflow in the `icalmemory strdup and dequote` function when processing certain email messages, potentially leading to a crash. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 60.7.1, update to version 60.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of email messages that could trigger the `icalmemory strdup and dequote` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** HylaFAX version 6.0.6 HylaFAX+ version 5.6.0 **Description** The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file. **Recommendations** For HylaFAX version 6.0.6, consider disabling the `FaxModem::writeECMData()` function until a patch is available. For HylaFAX+ version 5.6.0, restrict access to the faxd/CopyQuality.c++ file to minimize the risk of exploitation.