Mehdi Talbi

**Name of the Vulnerable Software and Affected Versions** Philips Hue Bridge (affected versions not specified) **Description** A heap-based buffer overflow exists in the custom command handler of the Zigbee stack. This issue occurs due to insufficient validation of data size before it is copied into a fixed-size heap buffer during the processing of custom Zigbee ZCL (Zigbee Cluster Library) frames within the Model Info download functionality. Network-adjacent attackers can exploit this flaw to execute arbitrary code in the context of the device. Exploitation requires user interaction, specifically that the user must initiate the device pairing process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Canon imageCLASS MF644Cdw version 10.02 **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the CADM service, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** For Canon imageCLASS MF644Cdw version 10.02, as a temporary workaround, consider disabling the CADM service until a patch is available. Restrict access to the CADM service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** bhyve (affected versions not specified) **Description** The e1000 network adapters allow modifications to Ethernet packets during transmission, including IP and TCP checksum insertion, Ethernet VLAN header insertion, and TCP segmentation offload. The e1000 device model uses an on-stack buffer to generate modified packet headers. When checksum offload is requested for a transmitted packet, the e1000 device model uses a guest-provided value to specify the checksum offset in the on-stack buffer, which was not validated for certain packet types. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context. The bhyve process runs in a Capsicum sandbox, which limits the impact of exploiting this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.