Matthew Hall

**Name of the Vulnerable Software and Affected Versions** GnuTLS versions prior to 3.0.15 GnuTLS versions prior to 2.12.18 **Description** The issue affects the gnutls package in Gentoo Linux, potentially compromising the confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. Specifically, `gnutls cipher.c` in `libgnutls` does not properly handle data encrypted with a block cipher, allowing remote attackers to cause a denial of service via a crafted record, such as a crafted `GenericBlockCipher` structure. **Recommendations** For versions prior to 2.12.18, update to version 2.12.18 or later. For versions prior to 3.0.15, update to version 3.0.15 or later. As a temporary workaround, consider restricting access to the `gnutls cipher.c` function in `libgnutls` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GNU Libtasn1 versions prior to 2.12 GnuTLS versions prior to 3.0.16 **Description** The issue arises from the improper handling of certain large length values by the `asn1 get length der` function in GNU Libtasn1. This can be exploited by remote attackers to cause a denial of service, resulting in heap memory corruption and application crash, or possibly have other unspecified impacts through a crafted ASN.1 structure. **Recommendations** For GNU Libtasn1 versions prior to 2.12, update to version 2.12 or later to resolve the issue. For GnuTLS versions prior to 3.0.16, update to version 3.0.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the `asn1 get length der` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Barracuda Spam Firewall (BSF) versions 3.3.01.001 through 3.3.03.053 **Description** The issue allows remote attackers to execute commands via shell metacharacters, specifically the "|" pipe symbol, in the `file` parameter of the `preview email.cgi` script. This can potentially be extended to execute arbitrary commands. **Recommendations** For versions 3.3.01.001 through 3.3.03.053, consider restricting access to the `preview email.cgi` script until a fix is available, and avoid using the "|" pipe symbol in the `file` parameter to minimize the risk of exploitation.