Mateusz Kocielski

**Name of the Vulnerable Software and Affected Versions** Cherokee versions 1.2.104 and earlier **Description** A cross-site scripting (XSS) issue was discovered in the handler server info.c file. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. This XSS issue can be used to reconfigure the server and execute arbitrary commands through the administrator panel. **Recommendations** For Cherokee versions 1.2.104 and earlier, consider disabling the About page in the default configuration of the web server and its administrator panel as a temporary workaround until a patch is available. Restrict access to the administrator panel to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cherokee versions 1.2.104 and earlier **Description** The issue allows remote attackers to trigger an out-of-bounds write in `cherokee handler cgi add env pair` in `handler cgi.c` by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers. **Recommendations** For Cherokee versions 1.2.104 and earlier, as a temporary workaround, consider restricting the number of request headers allowed to prevent exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cherokee versions 1.2.104 and earlier **Description** The issue is related to multiple memory corruption errors that can be exploited by a remote attacker to destabilize the work of a server. **Recommendations** For Cherokee versions 1.2.104 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bozohttpd in NetBSD versions 6.0 through 6.0.6 bozohttpd in NetBSD versions 6.1 through 6.1.5 bozohttpd in NetBSD versions 7.0 **Description** A flaw in CGI handling in bozohttpd allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program. **Recommendations** For NetBSD versions 6.0 through 6.0.6, update to a version that includes the fix for the CGI handling flaw. For NetBSD versions 6.1 through 6.1.5, update to a version that includes the fix for the CGI handling flaw. For NetBSD version 7.0, update to a version that includes the fix for the CGI handling flaw.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions prior to 8.4 p24 FreeBSD versions 9.x prior to 9.3 p10 FreeBSD versions 10.0 prior to p18 FreeBSD versions 10.1 prior to p6 **Description** The issue is caused by an integer overflow that allows remote attackers to trigger a denial of service, resulting in a system crash. This is achieved by sending a crafted IGMP packet, which causes an incorrect size calculation and allocation of insufficient memory. **Recommendations** For FreeBSD versions prior to 8.4 p24, update to version 8.4 p24 or later. For FreeBSD versions 9.x prior to 9.3 p10, update to version 9.3 p10 or later. For FreeBSD versions 10.0 prior to p18, update to version 10.0 p18 or later. For FreeBSD versions 10.1 prior to p6, update to version 10.1 p6 or later.

**Name of the Vulnerable Software and Affected Versions** stunnel versions 4.21 through 4.54 stunnel version 4.29 **Description** The issue arises when the CONNECT protocol negotiation and NTLM authentication are enabled in stunnel, leading to incorrect integer conversion. This allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow. Exploitation of this issue can lead to a violation of confidentiality, integrity, and availability of protected information and can be carried out remotely. **Recommendations** For stunnel versions 4.21 through 4.54, update to a version later than 4.54 to resolve the issue. For stunnel version 4.29, update to a version later than 4.29 to resolve the issue. As a temporary workaround, consider disabling NTLM authentication and CONNECT protocol negotiation until a patch is available. Restrict access to the stunnel service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSSH versions 5.6 through 5.7 **Description** The issue is related to the key certify function in OpenSSH, specifically when generating legacy certificates using the -t command-line option in ssh-keygen. This function does not initialize the nonce field, which could allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks. **Recommendations** For OpenSSH versions 5.6 through 5.7, consider disabling the use of the -t command-line option in ssh-keygen until a patch is available. As a temporary workaround, restrict access to the key certify function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP versions 5.2 before 5.2.15 PHP versions 5.3 before 5.3.4 **Description** A double free vulnerability in the `imap do open` function in the IMAP extension allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors. **Recommendations** For PHP version 5.2, update to version 5.2.15 or later. For PHP version 5.3, update to version 5.3.4 or later.