Zdi

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw exists in GIMP’s parsing of XWD files, leading to a potential out-of-bounds write. This can allow a remote attacker to execute arbitrary code on systems running affected versions of GIMP. User interaction is required, as the target must open a malicious file or visit a malicious page. The issue stems from insufficient validation of user-supplied data, which can lead to writing beyond the bounds of an allocated buffer. An attacker could exploit this to execute code within the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw exists in the parsing of XCF files within GIMP, leading to a use-after-free condition. This allows remote attackers to potentially execute arbitrary code on affected systems. User interaction is required, specifically the need for a target to open a malicious file or visit a malicious page. The issue stems from a lack of validation to confirm the existence of an object before operations are performed on it, which an attacker can exploit to execute code within the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PDFsam Enhanced App (affected versions not specified) **Description** The PDFsam Enhanced App contains an out-of-bounds read issue that can lead to remote code execution. The issue was discovered by ZDI. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PDFsam Enhanced (affected versions not specified) **Description** A flaw exists in PDFsam Enhanced related to the processing of XLS files. This allows a remote attacker to execute arbitrary code on affected systems. User interaction is required, specifically the target must open a malicious file or visit a malicious page. The issue stems from the execution of dangerous scripts without providing a warning to the user, enabling an attacker to execute code with the privileges of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Soda PDF Desktop (affected versions not specified) **Description** A flaw exists in the parsing of PDF files within Soda PDF Desktop. The issue stems from insufficient validation of user-supplied data, potentially leading to a read past the end of an allocated object. An attacker could leverage this, potentially in combination with other issues, to disclose sensitive information. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger the issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole (affected versions not specified) Description: This issue allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole without requiring authentication. The problem lies in the implementation of the `decryptFile` method, which lacks proper validation of a user-supplied path before using it in file operations. This can be exploited to write files in the context of SYSTEM. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.