Stefan Bühler

**Name of the Vulnerable Software and Affected Versions** Alinto SOPE SOGo versions 2.0.2 through 5.12.2 **Description** This issue involves a NULL pointer dereference in `sope-core/NGExtensions/NGHashMap.m` that can lead to a crash of the SOGo application. The vulnerability occurs when a request contains a parameter in the query string that duplicates a parameter in the POST body. Approximately 30,000 installations of SOGo are tracked in the Russian internet space, with an estimated 98% being vulnerable. While mass exploitation has not been observed, the vulnerability allows for remote, unauthenticated denial-of-service attacks. **Recommendations** Update SOGo to version 5.12.3 or later to resolve this issue. Restart the service to reset active sessions.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 28 **Description** The issue allows remote attackers to conduct a persistent Logout CSRF attack by sending HTTP Cookie headers without proper validation of required character-set restrictions. This can be achieved via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response. **Recommendations** For Mozilla Firefox versions prior to 28, update to version 28 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** lighttpd versions prior to 1.4.33 **Description** The issue is related to the failure of lighttpd to check the return value of certain functions, specifically `setuid`, `setgid`, and `setgroups`. This oversight might cause lighttpd to run as root if it is restarted, potentially allowing remote attackers to gain privileges. This can be demonstrated through multiple calls to the `clone` function, which can cause `setuid` to fail when the user process limit is reached. **Recommendations** For versions prior to 1.4.33, update to version 1.4.33 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources and monitoring system logs for potential exploitation attempts.

**Name of the Vulnerable Software and Affected Versions** lighttpd versions prior to 1.4.33 **Description** The issue is related to a use-after-free vulnerability that allows remote attackers to cause a denial of service, resulting in a segmentation fault and crash. This is triggered by unspecified vectors that cause FAMMonitorDirectory failures. **Recommendations** For versions prior to 1.4.33, update to version 1.4.33 or later to resolve the issue. As a temporary workaround, consider restricting access to the FAMMonitorDirectory function until a patch is available.