Markus Vervier

**Name of the Vulnerable Software and Affected Versions** LiteLLM versions prior to 1.83.11 **Description** A flaw in the proxy server allows remote attackers to execute arbitrary code via bytecode rewriting. The issue exists because the `POST /guardrails/test custom code` endpoint runs user-supplied Python within a custom sandbox that can be escaped using bytecode-level techniques. This allows the execution of malicious code within the proxy process, which typically runs as root in the default Docker image. In default configurations, accessing this endpoint requires proxy-admin credentials. **Recommendations** Update to version 1.83.11 or later. As a temporary workaround, block the `POST /guardrails/test custom code` endpoint at the reverse proxy or API gateway.

**Name of the Vulnerable Software and Affected Versions** GitHub Copilot (affected versions not specified) Visual Studio 2022 versions prior to 17.14.12 **Description** Improper neutralization of special elements used in a command leads to a command injection issue in GitHub Copilot and Visual Studio, allowing an unauthorized attacker to execute code locally. This can be achieved through prompt injection, where an attacker hides malicious instructions within a repository comment, README, or PR description. The AI assistant may be tricked into modifying the `.vscode/settings.json` file to enable an auto-approve mode, which allows the agent to execute arbitrary bash commands in the terminal without human confirmation. **Recommendations** Update Visual Studio 2022 to version 17.14.12. At the moment, there is no information about a newer version that contains a fix for this vulnerability for GitHub Copilot.

**Name of the Vulnerable Software and Affected Versions** Git versions prior to 2.30.7 **Description** The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both. **Recommendations** For Git versions prior to 2.30.7, upgrade to a version published on or after 2023-01-17 to resolve the issue. As a temporary workaround, consider restricting the use of the `.gitattributes` file until a patch is applied. Avoid using huge numbers of path patterns, attributes for a single pattern, or huge declared attribute names in the `.gitattributes` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Wire versions prior to 2022-05-04-production.0 Wire-server versions prior to 2022-05-04 (chart/4.11.0) **Description** The issue concerns arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim, allowing the attacker to fully control the user account. Wire-desktop clients connected to a vulnerable wire-webapp version are also vulnerable to this attack. **Recommendations** For wire-webapp versions prior to 2022-05-04-production.0, update to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or later. For wire-server versions prior to 2022-05-04 (chart/4.11.0), update to version 2022-05-04 (chart/4.11.0) or later. As a temporary workaround, consider disabling the rendering of `@mentions` in the wire-webapp until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Telenot CompasX versions prior to 32.0 **Description** The issue is related to the use of a weak seed for random number generation, which leads to predictable AES keys used in NFC tags for local authorization of users. This may result in the total loss of trustworthiness of the installation. **Recommendations** For versions prior to 32.0, update to version 32.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of NFC tags for authorization until a patch is available.

Name of the Vulnerable Software and Affected Versions: Avira AntiVir Engine versions prior to 8.2.12.58 Description: A Denial of Service vulnerability exists due to an infinite loop in an unspecified function within the PDF Scanner Engine. Recommendations: For Avira AntiVir Engine versions prior to 8.2.12.58, update to version 8.2.12.58 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 65 **Description** The issue is caused by a buffer overflow in the Texture Client Handler component of the Firefox browser, allowing a remote attacker to potentially cause a denial of service using a specially crafted web page. It can also lead to a crash and out-of-bounds read when a texture client's buffer is freed while still in use during graphic operations, potentially allowing the reading of memory from freed buffers. **Recommendations** For versions prior to 65, update to version 65 or later to resolve the issue. As a temporary workaround, consider restricting the use of graphic-intensive operations until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** HylaFAX version 6.0.6 HylaFAX+ version 5.6.0 **Description** The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file. **Recommendations** For HylaFAX version 6.0.6, consider disabling the `FaxModem::writeECMData()` function until a patch is available. For HylaFAX+ version 5.6.0, restrict access to the faxd/CopyQuality.c++ file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PSFTPd version 10.0.4 Build 729 **Description** The issue allows attackers to hide data in the Graphical User Interface (GUI) view and create arbitrary entries to a certain extent by not properly escaping data before writing it into a Comma Separated Values (CSV) file. Special characters such as `"`, `,` and `r` are not escaped and can be used to add new entries to the log. **Recommendations** For PSFTPd version 10.0.4 Build 729, consider implementing proper data escaping before writing to CSV files to prevent the addition of arbitrary log entries. As a temporary workaround, restrict the use of special characters in input data to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PSFTPd version 10.0.4 Build 729 **Description** The issue allows FTP bounce scans to be performed by default, which can be exploited using commands like "nmap -b". This enables scans to be conducted via the FTP server. **Recommendations** For PSFTPd version 10.0.4 Build 729, consider configuring the server to prevent FTP bounce scans as a mitigation measure.

**Name of the Vulnerable Software and Affected Versions** libotr versions prior to 4.1.1 **Description** The issue is caused by an integer overflow in the proto.c file of libotr, which can lead to memory corruption and application crash, or potentially allow execution of arbitrary code. This occurs when a series of large OTR messages are sent, triggering a heap-based buffer overflow. The issue is specific to 64-bit platforms. **Recommendations** For versions prior to 4.1.1, update to version 4.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the size of OTR messages to prevent the overflow.

**Name of the Vulnerable Software and Affected Versions** rsyslog versions prior to 7.4.2 rsyslog versions prior to 7.5.2 devel **Description** The issue is related to a double free vulnerability in the writeDataError function within the ElasticSearch plugin (omelasticsearch) of rsyslog. This vulnerability can be exploited by remote attackers when the errorfile is set to local logging, allowing them to cause a denial of service (crash) and potentially execute arbitrary code via a crafted JSON response. **Recommendations** For versions prior to 7.4.2, update to version 7.4.2 or later. For versions prior to 7.5.2 devel, update to version 7.5.2 devel or later.

**Name of the Vulnerable Software and Affected Versions** PyPam versions 0.5.0 and earlier **Description** A double free issue in the PyPAM conv function in PAMmodule.c allows remote attackers to cause a denial of service, potentially leading to application crashes, or possibly execute arbitrary code. This can be achieved by including a NULL byte in a password string. **Recommendations** For PyPam versions 0.5.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.