Robert Święcki

**Name of the Vulnerable Software and Affected Versions** GnuTLS versions prior to 3.3.14 **Description** The issue is related to a double free vulnerability in the lib/x509/x509 ext.c component of GnuTLS. This vulnerability can be exploited by remote attackers using a crafted CRL distribution point, potentially leading to a denial of service or other unspecified impacts. **Recommendations** For versions prior to 3.3.14, update to version 3.3.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the `lib/x509/x509 ext.c` component until a patch is available. Avoid using the vulnerable component with crafted CRL distribution points to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 3.17.2 **Description** The issue allows local users to cause a denial of service or bypass the ASLR protection mechanism via a crafted application. This is due to the kernel's failure to properly handle private syscall numbers during use of the perf subsystem, leading to an out-of-bounds read and OOPS. **Recommendations** For Linux kernel versions through 3.17.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** policycoreutils version 2.2.5 policycoreutils versions prior to 2.2.5-r4 **Description** The issue concerns a problem where a program executes in a way that alters the relationship between the setuid system call and the getresuid saved set-user-ID value. This makes it easier for local users to gain privileges by exploiting a program that mistakenly expected it could permanently drop privileges. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information and can be exploited locally. **Recommendations** For policycoreutils version 2.2.5, consider updating to a version newer than 2.2.5-r4 to resolve the issue. For policycoreutils versions prior to 2.2.5-r4, update to version 2.2.5-r4 or newer to fix the problem. As a temporary workaround, consider restricting the use of the setuid system call or the getresuid function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.14 Mozilla Firefox versions 3.6.x prior to 3.6.11 SeaMonkey versions prior to 2.0.9 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via a crafted name of a file or directory on a Gopher server, due to multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser. **Recommendations** For Mozilla Firefox versions prior to 3.5.14, update to version 3.5.14 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.11, update to version 3.6.11 or later. For SeaMonkey versions prior to 2.0.9, update to version 2.0.9 or later.