CVE-2023-29529 matrix-js-sdk vulnerable to invisible eavesdropping in group calls

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker...

@eweser/db (>=1.4.1 <=1.6.2), @medicaa/trustie (>=0.0.1 <=0.0.3) +36 more potentially affected by CVE-2023-29529 via matrix-js-sdk (>=0.0.4 <=24.1.0-rc.1)

matrix-js-sdk NPM version =0.0.4, =1.4.1, =0.0.1, =0.17.0, =4.0.1, =1.2.0, =1.1.0, =0.1.6, =0.1.11, =0.1.0, =0.0.1, =0.11.1-7, =1.6.0, =1.0.33, =1.1.5 and more Source cves: CVE-2023-29529 Source advisory: OSV:GHSA-6G67-Q39G-R79Q...

GHSA-6G67-Q39G-R79Q matrix-js-sdk vulnerable to invisible eavesdropping in group calls

Impact An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possibl...

matrix-js-sdk vulnerable to invisible eavesdropping in group calls

Impact An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possibl...

matrix-js-sdk 安全漏洞

matrix-js-sdk is an application component of matrix open source. A security vulnerability exists in matrix-js-sdk. An attacker exploited the vulnerability to eavesdrop on video and audio using matrix-js-sdk without the participant's knowledge...

Fedora 36 : thunderbird (2023-0e1ae0d5f6)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0e1ae0d5f6 advisory. Update to 102.9.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/ ; https://www.thunderbird.net/en-US/thunderbird/102.9.1/releasenotes/ ----...

Updated thunderbird packages fix security vulnerability

Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack. CVE-2023-28427...

MGASA-2023-0132 Updated thunderbird packages fix security vulnerability

Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack. CVE-2023-28427...

DevOps threat matrix

The use of DevOps practices, which enable organizations to deliver software more quickly and efficiently, has been on the rise. This agile approach minimizes the time-to-market of new features and bug fixes. More and more companies are implementing DevOps services, each with its own infrastructur...

Prototype Pollution

matrix-js-sdk is vulnerable to Prototype Pollution. Events sent with special strings in key places may disrupt or impede the library from functioning properly, potentially impacting the consumer's ability to process data safely...

Prototype Pollution

matrix-react-sdk is vulnerable to Prototype Pollution. The vulnerability exists because, in certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype which may lead to an application crash...

The vulnerability of the JavaScript and TypeScript matrix-js-sdk development tools lies in the uncontrolled modification of prototype properties of objects, allowing attackers to trigger a service failure.

The vulnerability of the JavaScript and TypeScript matrix-js-sdk development tools is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using specially created input data...

Fedora 38 : thunderbird (2023-a9c17dff60)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a9c17dff60 advisory. Update to 102.9.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/ ; https://www.thunderbird.net/en-US/thunderbird/102.9.1/releasenotes/...

SUSE CVE-2023-28427

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data...

Fedora 37 : thunderbird (2023-d093c0cd27)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d093c0cd27 advisory. Update to 102.9.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/ ; https://www.thunderbird.net/en-US/thunderbird/102.9.1/releasenotes/...

@eweser/db (>=1.4.1 <=1.6.2), @medicaa/trustie (>=0.0.1 <=0.0.3) +36 more potentially affected by CVE-2023-28427 via matrix-js-sdk (>=0.0.4 <=23.5.0)

matrix-js-sdk NPM version =0.0.4, =1.4.1, =0.0.1, =0.17.0, =4.0.1, =1.2.0, =1.1.0, =0.1.6, =0.1.11, =0.1.0, =0.0.1, =0.11.1-7, =1.6.0, =1.0.33, =1.1.5 and more Source cves: CVE-2023-28427 Source advisory: OSV:GHSA-MWQ8-FJPF-C2GR...

GHSA-MWQ8-FJPF-C2GR Prototype pollution in matrix-js-sdk (part 2)

Impact In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic. This is part 2, where...

CVE-2023-28427

The Mozilla Foundation Security Advisory describes this flaw as: Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2023-088-01)

The version of mozilla-thunderbird installed on the remote host is prior to 102.9.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-088-01 advisory. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sen...

matrix-react-skin (>=0.0.1 <=0.0.2), vector-web (=0.3.0) potentially affected by CVE-2023-28103 via matrix-react-sdk (>=0.0.1 <=0.2.0)

matrix-react-sdk NPM version =0.0.1, =0.0.1, =0.0.2 - vector-web =0.3.0 Source cves: CVE-2023-28103 Source advisory: OSV:GHSA-6G43-88CP-W5GV...