Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 vul check tools This vulnerability allows an at...

Urgent: Secret Backdoor Found in XZ Utils Library, Impacts Major Linux Distros

Red Hat on Friday released an "urgent security alert" warning that two versions of a popular data compression library called XZ Utils previously LZMA Utils have been backdoored with malicious code designed to allow unauthorized remote access. The software supply chain compromise, tracked as...

XZ Utils SSHd Backdoor

On March 29th, 2024, security researcher Andres Freund discovered a backdoor in XZ Utils versions 5.6.0 and 5.6.1. Under certain conditions, this backdoor may allow remote access to the targeted system. This disclosure was posted to the Openwall mailing list. The security researcher mentions that...

Backdoor in XZ Utils allows RCE: everything you need to know

Detect and mitigate CVE-2024-3094, a critical supply chain compromise, affecting XZ Utils Data compression library. Organizations should patch urgently...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094-Vulnerabity-Checker Verify that your XZ Utils ve...

[SECURITY] [DSA 5649-1] xz-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5649-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 29, 2024 https://www.debian.org/security/faq -...

Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094

CISA and the open source community are responding to reports of malicious code being embedded in XZ Utils versions 5.6.0 and 5.6.1. This activity was assigned CVE-2024-3094link is external. XZ Utils is data compression software and may be present in Linux distributions. The malicious code may all...

Prototype Pollution

web3-utils is vulnerable to Prototype Pollution. The vulnerability is due to insecure recursive merge via the utility functions format and mergeDeep, allowing an attacker to manipulate an object's prototype by passing specially crafted input to these functions...

Tukaani XZ Utils Installed (Linux / Unix)

Binary data xzutilsnixinstalled.nbin...

XZ utils: Backdoor in release tarballs

Background XZ Utils is free general-purpose data compression software with a high compression ratio. Description A backdoor has been discovered in XZ utils. Please review the CVE identifier referenced below for details. Impact Our current understanding of the backdoor is that is does not affect...

xz 安全漏洞

xz is a software application. Used to support reading and writing xz compressed streams. A security vulnerability exists in XZ Utils version 5.6.0 and 5.6.1, which stems from a vulnerability that allows attackers to embed malicious code...

Potential exposure to XZ Utils SSH Backdoor (CVE-2024-3094)

Binary data xzutilsbackdoorcve-2024-3094.nbin...

PT-2024-2451

Name of the Vulnerable Software and Affected Versions xz versions 5.6.0 through 5.6.1 Description Malicious code was discovered in the upstream tarballs of xz. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file in the...

GHSA-2G4C-8FPM-C46V web3-utils Prototype Pollution vulnerability

Impact: The mergeDeep function in the web3-utils package has been identified for Prototype Pollution vulnerability. An attacker has the ability to modify an object's prototype, which could result in changing the behavior of all objects that inherit from the impacted prototype by providing careful...

@hyperledger/cactus-plugin-htlc-coordinator-besu (2.0.0-alpha.2), @hyperledger/cactus-plugin-persistence-ethereum (>=2.0.0-2945-supply-chain-app-build-failed.241, <=2.0.0-main.214) +19 more potentially affected by CVE-2024-21505 via web3-utils (>=4.0.2, <=4.1.2-dev.998954f.0)

web3-utils NPM version =4.0.2, =2.0.0-2945-supply-chain-app-build-failed.241, =2.0.0-2945-supply-chain-app-build-failed.241, =0.0.88, =0.0.84, =0.0.244-test-deposit-improve-v19, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0,...

web3-utils Prototype Pollution vulnerability

Impact: The mergeDeep function in the web3-utils package has been identified for Prototype Pollution vulnerability. An attacker has the ability to modify an object's prototype, which could result in changing the behavior of all objects that inherit from the impacted prototype by providing careful...

GHSA-87QP-7CW8-8Q9C Duplicate Advisory: web3-utils Prototype Pollution vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2g4c-8fpm-c46v. This link is maintained to preserve external references. Original Description Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions forma...

Duplicate Advisory: web3-utils Prototype Pollution vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2g4c-8fpm-c46v. This link is maintained to preserve external references. Original Description Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions forma...

CVE-2024-21505

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting...

CVE-2024-21505

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting...