Yufan You

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Improperly crafted zones may cause increased resource consumption. Additionally, crafted CNAME chains can lead to cache poisoning within the Recursor.

The issue affects the Zip Repair Mode of LibreOffice, where an improper digital signature invalidation vulnerability allows for signature forgery. This means an attacker could create a specially crafted document that, after repair, would report a valid electronic signature status, potentially deceiving users about the document's authenticity.

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

The issue allows an attacker in the same WLAN as the victim to hijack traffic between the victim and any remote server by sending forged ICMP redirect messages. This can be exploited by an attacker in the same wireless network.

The issue allows an attacker in the same WLAN as the victim to disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router. This can lead to TCP DoS or hijacking attacks.

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-7DR5130 version 1.0.23 Description: The issue is related to the mechanism of transmitting routing information to hosts via ICMP Redirect in the TP-LINK TL-7DR5130 wireless router's firmware. It is associated with insufficient verification of the communication channel source. An attacker in the same WLAN as the victim can exploit this by sending specially crafted ICMP messages to hijack the traffic between the victim and any remote server. Recommendations: For TP-LINK TL-7DR5130 version 1.0.23, consider restricting access to the network to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the handling of ICMP redirect messages could help mitigate the issue. However, specific steps for this action are not provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-7DR5130 version 1.0.23 Description: The issue is related to insufficient validation of the communication channel source, which can be exploited by an attacker to perform a TCP Reset attack. This can be done by sending specially crafted RST messages to a remote server, potentially allowing the attacker to disconnect or hijack the traffic between the victim and the server. An attacker in the same WLAN as the victim can exploit this by sending forged TCP RST messages to evict NAT mappings in the router. Recommendations: For TP-LINK TL-7DR5130 version 1.0.23, consider restricting access to port 50005 as a temporary workaround to minimize the risk of exploitation. Additionally, avoid using the router's WLAN functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create a zip file with contents that vary depending on the implementation reading the file. The issue is related to the incorrect handling of zip files, which could allow an attacker to create an arbitrary zip file.