Yoshihiro Ishikawa

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 6 through 11 **Description** A use-after-free issue in the SetMouseCapture implementation in mshtml.dll allows remote attackers to execute arbitrary code via crafted JavaScript strings. This could corrupt memory, enabling an attacker to execute arbitrary code in the context of the current user. There have been real-world incidents where this issue was exploited, including attacks by the APT17 group targeting national companies and government institutions with the 9002 RAT malware. The attacks involved phishing lures that tricked recipients into downloading a malicious Skype for Business installer, which then executed a Java archive file to launch the 9002 RAT. The 9002 RAT has features such as network traffic monitoring, screenshot creation, file scanning, process management, and executing additional commands received from the command and control server. **Recommendations** For Microsoft Internet Explorer versions 6 through 11, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling JavaScript execution in Internet Explorer until a patch is available. Restrict access to suspicious links and attachments to minimize the risk of exploitation. Avoid using links from untrusted sources, especially those that prompt for the installation of software.

**Name of the Vulnerable Software and Affected Versions** Samba versions 3.5.6 Samba versions prior to 3.5.10 cifs-utils version 4.8.1 **Description** The issue concerns multiple vulnerabilities in the Samba software package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, the Samba Web Administration Tool (SWAT) in Samba 3.x is affected by multiple cross-site request forgery (CSRF) vulnerabilities, allowing remote attackers to hijack the authentication of administrators for various requests, such as shutting down daemons, starting daemons, adding shares, removing shares, adding printers, removing printers, adding user accounts, or removing user accounts. **Recommendations** For Samba versions 3.5.6, consider updating to a version prior to 3.5.10 to mitigate the risk. For cifs-utils version 4.8.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the Samba Web Administration Tool (SWAT) to minimize the risk of exploitation. Avoid using the Samba software package until the issue is resolved.