Risk: Medium
Six highly critical Lotus Notes vulnerabilities have been fixed by IBM, all of which related to file attachments.
Three of the flaws are similar - extracting a file with a long filename causes a buffer overflow - one flaw involves the extraction of a zipped file, another with the extraction of a UUE file and the final with a TAR file.
Two flaws occur in the HTML speed reader when it handles long links; one allows arbitrary code execution and the other causes a stack-based buffer overflow.
The third flaw arises when generating previews of compressed files in attached ZIP, UUE or TAR files, using the Notes attachment viewer, whereby hackers can use this flaw to delete arbitrary files.
Versions 6.5.5 and 7.0.1 are available for upgrade, and IBM has also issued some workarounds.