Niko Tyni

**Name of the Vulnerable Software and Affected Versions** HTML::Gumbo versions prior to 0.19 **Description** Type confusion occurs when the `walk tree()` function in `lib/HTML/Gumbo.xs` fails to properly handle the `<template>` element. This element is incorrectly treated as a text node, causing `strlen()` to over-read the heap block. When the `parse()` function is called with the `format` variable set to either `string` or `tree` on input containing a `<template>` element, bounded heap contents are disclosed in the returned result. Calls using `format` set to `callback` are not affected as they trigger a croak on the unhandled node type. **Recommendations** Update HTML::Gumbo to version 0.19 or later.

**Name of the Vulnerable Software and Affected Versions** libcapsinetwork and monopd versions prior to 0.9.8 **Description** The issue is caused by an off-by-one error in the readBuf function in listener.cpp, which allows remote attackers to cause a denial of service (crash) via a long line. **Recommendations** For versions prior to 0.9.8, update to version 0.9.8 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: typespeed versions 0.4.4 and earlier Description: A buffer overflow issue exists in the addnewword function, potentially allowing remote attackers to execute arbitrary code. The exact vectors of the attack are not specified. Recommendations: For typespeed versions 0.4.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** libmail-audit-perl version 2.1-5 **Description** The Mail::Audit module in libmail-audit-perl has an issue when logging is enabled without a default log file specified. It uses predictable log filenames, which allows local users to overwrite arbitrary files via a symlink attack on the temporary file. **Recommendations** For libmail-audit-perl version 2.1-5, consider specifying a default log file when logging is enabled to prevent the use of predictable log filenames. As a temporary workaround, restrict access to the logging functionality to minimize the risk of exploitation.