Mattia Ricciardi

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions 2.73 through 2.92 **Description** A heap buffer overflow exists in the DNS cache when processing DNS responses. The `extract name()` function can be abused because the software expands certain characters into longer escape sequences without ensuring the cache buffer is sized to hold the expanded result. Specifically, an unsafe `strcpy()` in the `really insert()` function within `src/cache.c` copies attacker-controlled name strings without bounds validation, overflowing a 1,025-byte bigname cache buffer. An attacker can exploit this by using a malicious upstream DNS server and crafted CNAME chains to corrupt memory, potentially leading to remote code execution, DNS cache poisoning to redirect lookups to attacker-controlled IP addresses, or a denial of service (DoS). **Recommendations** Update dnsmasq to version 2.92rel2 or 2.93.

**Name of the Vulnerable Software and Affected Versions** VTiger CRM versions <= 8.1.0 **Description** The issue arises from improper sanitization of user input before it is used in a SQL statement, leading to a SQL Injection in the `CompanyDetails` operation of the `MailManager` module. **Recommendations** For VTiger CRM versions <= 8.1.0, update to a version higher than 8.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the `MailManager` module to minimize the risk of exploitation. Avoid using the `CompanyDetails` operation until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** VTiger CRM versions <= 8.1.0 **Description** The issue concerns incorrect user privilege checking, allowing a low-privileged user to interact directly with the "Migration" administrative module. This enables the user to disable arbitrary modules. **Recommendations** For VTiger CRM versions <= 8.1.0, update to a version that includes the necessary privilege checks to prevent low-privileged users from accessing the "Migration" administrative module. As a temporary workaround, consider restricting access to the "Migration" module to minimize the risk of exploitation.