Nick Wellnhofer

**Name of the Vulnerable Software and Affected Versions** iconv(3) (affected versions not specified) **Description** Several encoding modules, including HZ, UTF-7, VIQR, and ZW, fail to properly validate the size of the output buffer provided by the caller before writing converted characters. This can lead to heap-based buffer overflows—a condition where data exceeds the allocated memory boundary—when an application uses the `iconv(3)` function to convert untrusted input to or from these specific encodings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iconv(3) (affected versions not specified) **Description** The ISO-2022 encoding module uses a stack buffer sized to `MB LEN MAX` (6 bytes) for intermediate character output. Because certain ISO-2022 variants can require up to 10 bytes per character, conversions may trigger a stack buffer overflow of up to four bytes. Applications using the `iconv(3)` function to convert untrusted input to or from these affected encodings are susceptible to this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libxml2 (affected versions not specified) **Description** An uncontrolled recursion issue exists in libxml2, an XML parsing library, specifically within the `xmlCatalogXMLResolveURI` function. This occurs when an XML catalog includes a delegate URI entry that points to itself. An attacker can exploit this by supplying a crafted XML catalog, causing infinite recursion and call stack exhaustion. This results in a segmentation fault, leading to a Denial of Service (DoS) by crashing applications. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** musl libc versions 0.9.13 through 1.2.5 **Description** The issue is related to an out-of-bounds write vulnerability in musl libc when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8. This can be exploited when an application calls `iconv open` with output encoding UTF-8 and input encoding EUC-KR and subsequently processes untrusted input. The vulnerability exposes applications using musl libc to remote code execution. **Recommendations** For musl libc versions 0.9.13 through 1.2.5, update to version 1.2.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of `iconv open` with untrusted input to minimize the risk of exploitation. Avoid using `iconv` with output encoding UTF-8 and input encoding EUC-KR for untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apple tvOS versions prior to 17.5 Apple visionOS versions prior to 1.2 Apple iOS versions prior to 17.5 Apple iPadOS versions prior to 17.5 Apple watchOS versions prior to 10.5 Apple macOS Sonoma versions prior to 14.5 **Description** The issue allows an app to potentially elevate privileges due to inadequate checks. This could lead to unauthorized access or control. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For Apple tvOS versions prior to 17.5, update to tvOS 17.5 to resolve the issue. For Apple visionOS versions prior to 1.2, update to visionOS 1.2 to resolve the issue. For Apple iOS versions prior to 17.5, update to iOS 17.5 to resolve the issue. For Apple iPadOS versions prior to 17.5, update to iPadOS 17.5 to resolve the issue. For Apple watchOS versions prior to 10.5, update to watchOS 10.5 to resolve the issue. For Apple macOS Sonoma versions prior to 14.5, update to macOS Sonoma 14.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 91.0.4472.164 **Description** The issue is related to a use after free in Blink XSLT, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This could lead to a denial of service. **Recommendations** For versions prior to 91.0.4472.164, update to version 91.0.4472.164 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious HTML pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** libxml2 versions prior to 2.9.5 Google Chrome versions prior to 63.0.3239.84 **Description** A use after free issue in libxml2 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This issue affects various products, including Google Chrome and Opera. **Recommendations** For libxml2 versions prior to 2.9.5, update to version 2.9.5 or later to resolve the issue. For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libxslt in Apple iOS versions prior to 10 libxslt in Apple OS X versions prior to 10.12 libxslt in Apple tvOS versions prior to 10 libxslt in Apple watchOS versions prior to 3 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This is caused by a buffer overflow in the libxslt component of the operating systems, which can be exploited by a remote attacker using a specially formed web site. **Recommendations** For libxslt in Apple iOS versions prior to 10, update to iOS 10 or later. For libxslt in Apple OS X versions prior to 10.12, update to OS X 10.12 or later. For libxslt in Apple tvOS versions prior to 10, update to tvOS 10 or later. For libxslt in Apple watchOS versions prior to 3, update to watchOS 3 or later.

**Name of the Vulnerable Software and Affected Versions** libxml2 versions prior to 2.9.5 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to a use-after-free and memory corruption via a crafted XML document. This is because namespace nodes in XPointer ranges are not forbidden. The vulnerability may also lead to memory buffer overflow, potentially affecting the confidentiality, integrity, and availability of protected information. **Recommendations** For libxml2 versions prior to 2.9.5, update to version 2.9.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of XPointer ranges in XML documents to minimize the risk of exploitation. Avoid using crafted XML documents that may trigger the use-after-free and memory corruption until the issue is resolved.

libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4615, CVE-2016-4616, and CVE-2016-4619.

libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4615, and CVE-2016-4619.

libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4616, and CVE-2016-4619.

**Name of the Vulnerable Software and Affected Versions** ALT Linux (affected versions not specified) **Description** General information about the issue is not provided. There is no information about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libxslt for Apple iOS, OS X, iTunes, iCloud, tvOS, and watchOS (affected versions not specified) Description: The issue allows remote attackers to cause a denial of service (memory corruption) or have other impacts on the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libxslt for Apple iOS, OS X, iTunes, iCloud, tvOS, and watchOS (affected versions not specified) Description: The issue allows remote attackers to cause a denial of service (memory corruption) or have other impacts on the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libxml2 versions through 2.9.4 Google Chrome versions through 52.0.2743.82 **Description** The issue is related to a use-after-free vulnerability, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This vulnerability is related to vectors involving the XPointer range-to function. **Recommendations** For libxml2 versions through 2.9.4, update to a version later than 2.9.4 to resolve the issue. For Google Chrome versions through 52.0.2743.82, update to a version later than 52.0.2743.82 to resolve the issue.