Yuhei Kawakoya

**Name of the Vulnerable Software and Affected Versions** Linux Ratfor versions 1.06 and earlier **Description** A stack-based buffer overflow issue exists when the software processes a specially crafted file, allowing arbitrary code execution. This could enable an attacker to obtain or alter user environment information or render the environment unusable. **Recommendations** For Linux Ratfor versions 1.06 and earlier, as a temporary workaround, consider restricting the processing of specially crafted files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Assimp versions prior to 5.4.3 Description: A heap-based buffer overflow issue allows a local attacker to execute arbitrary code by importing a specially crafted file into the product. This can be achieved through the import functionality of the product. Recommendations: For versions prior to 5.4.3, update to version 5.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the import of files from untrusted sources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** xfpt versions prior to 1.01 **Description** The issue is related to a stack-based buffer overflow vulnerability. It occurs when the software fails to handle some parameters inside the input data correctly. This can be exploited by tricking a user into processing a specially crafted file, potentially allowing arbitrary code execution on the user's environment. The vulnerability is associated with the copying of a buffer without checking the size of the input data. **Recommendations** For xfpt versions prior to 1.01, consider disabling the processing of specially crafted files until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using the vulnerable parameters inside the input data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SDoP versions prior to 1.11 **Description** The issue is related to the handling of parameters inside input data, resulting in a stack-based buffer overflow. This can lead to arbitrary code execution when a user processes a specially crafted XML file. **Recommendations** For SDoP versions prior to 1.11, update to version 1.11 or later to resolve the issue. As a temporary workaround, consider restricting the processing of XML files from untrusted sources until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ORC versions prior to 0.4.39 **Description** A stack-based buffer overflow vulnerability exists in the orcparse.c file of the ORC compiler. If a developer is tricked into processing a specially crafted file with the affected ORC compiler, arbitrary code may be executed on the developer's build environment. This could lead to the compromise of developer machines or CI build environments. **Recommendations** For ORC versions prior to 0.4.39, update to version 0.4.39 or later to resolve the issue. As a temporary workaround, consider restricting the use of the affected ORC compiler until a patch is available. Avoid processing specially crafted files with the affected ORC compiler to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Assimp versions prior to 5.4.2 **Description** The issue is related to a heap-based buffer overflow vulnerability. It allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product. This can be achieved through the exploitation of the File Handler component in the Open Asset Import Library (Assimp), which is associated with the heap buffer overflow. **Recommendations** For versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue. As a temporary workaround, consider restricting the input of specially crafted files into the product until a patch is available.