Trung Nguyen

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 153.2 Thunderbird versions prior to 154 **Description** Malicious calendar invitations can utilize file URI attachments to execute local or network-hosted executables on Windows systems, bypassing standard executable attachment protections. When the new invitation display is enabled, these attachments may be presented with misleading filenames. **Recommendations** Update to version 153.2. Update to version 154.

**Name of the Vulnerable Software and Affected Versions** Unbound versions 1.9.0 through 1.25.1 **Description** A heap-based buffer overflow occurs when a DNSCrypt query is received over TCP. The routine responsible for encrypting the reply in place does not bound the reply length against the destination buffer size, failing to apply the size clamp used in the UDP path. Consequently, a reply exceeding 65504 bytes is shifted forward by 48 bytes within a buffer of capacity `msg-buffer-size`, resulting in a write operation past the end of the heap allocation. This can be triggered by a single malicious encrypted query, causing the resolver to crash and leading to a denial of service. This issue requires the software to be compiled with DNSCrypt support via `--enable-dnscrypt` and the `dnscrypt:` clause to be configured and enabled for listening interfaces. **Recommendations** Update Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `dnscrypt:` clause on listening interfaces or avoid compiling the software with the `--enable-dnscrypt` option.

**Name of the Vulnerable Software and Affected Versions** OpenShift Cluster Logging Operator (affected versions not specified) **Description** A missing authorization flaw exists in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying if the creator of the ClusterLogForwarder has the necessary permissions to use those credentials. This allows a delegated editor to exfiltrate ServiceAccount tokens and escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libzypp versions prior to 17.38.13-1.1 **Description** An issue exists allowing path traversal via the `keyhint` variable. **Recommendations** Update to version 17.38.13-1.1.

**Name of the Vulnerable Software and Affected Versions** Notepad++ (affected versions not specified) **Description** A zero-click remote code execution (RCE) issue exists due to path traversal. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0 through 3.0.16 Apache Syncope versions 4.0 through 4.0.5 Apache Syncope version 4.1.0 **Description** Improper Isolation or Compartmentalization allows an administrator with sufficient entitlements for Implementations to create a malicious Groovy class. This class can contain untrusted code that reaches a non-sandboxed execution path through the class static initializer, potentially leading to remote code execution. **Recommendations** For versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0, upgrade to version 4.0.6 or 4.1.1.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 7.0.0 **Description** The issue in QEMU's softmmu/physmem.c file can lead to an uninitialized read on the translate fail path, resulting in an io readx or io writex crash. A third party notes that this might not be considered a security bug according to the Non-virtualization Use Case in the qemu.org reference. The vulnerability is related to the use of an uninitialized variable in the address space translate for iotlb() function, which could allow an attacker to cause a denial of service or execute arbitrary code. **Recommendations** For QEMU versions prior to 7.0.0, consider updating to a version that includes the fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.