Mozilla: Incorrect value used during WASM compilation

The Mozilla Foundation Security Advisory describes this flaw as: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process...

Mozilla: Incorrect value used during WASM compilation

The Mozilla Foundation Security Advisory describes this flaw as: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process...

Mozilla: Incorrect value used during WASM compilation

The Mozilla Foundation Security Advisory describes this flaw as: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process...

CVE-2023-32783

The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. NOTE: the vendor states "We do not consider this as a security bug and it's an expected behaviour."...

JPCERT Coordination Center Special Interest Group Network for Analysis and Liaison Security Vulnerabilities

JPCERT Coordination Center Special Interest Group Network for Analysis and Liaison is an application of JPCERT Coordination Center, Inc. A security vulnerability exists in JPCERT Coordination Center Special Interest Group Network for Analysis and Liaison versions 4.4.0 through 4.7.7, which stems...

TargetCompany Ransomware Abuses FUD Obfuscator Packers

In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable FUD obfuscator engine BatCloak to infect vulnerable systems...

JPCERT Coordination Center Special Interest Group Network for Analysis and Liaison Security Vulnerabilities

JPCERT Coordination Center Special Interest Group Network for Analysis and Liaison is an application of JPCERT Coordination Center, Inc. A security vulnerability exists in JPCERT Coordination Center Special Interest Group Network for Analysis and Liaison versions 4.4.0 through 4.7.7, which stems...

CVE-2023-32783

The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. NOTE: the vendor states "We do not consider this as a security bug and it's an expected behaviour."...

MAL-2023-1092 Malicious code in @n9xcnr5test/n9xcnr5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 98235bbf40ea66c28973775cba8ead37bb4dc1d8999e5ebf02eb3157d4ba74be The OpenSSF Package Analysis project identified '@n9xcnr5test/n9xcnr5' @ 2001.0.0 npm as malicious. It is considered malicious because: - The...

Debian DSA-5464-1 : firefox-esr - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5464 advisory. Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, bypass of the...

Oracle Linux 7 : firefox (ELSA-2023-4461)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-4461 advisory. 102.14.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add...

AlmaLinux 9 : firefox (ALSA-2023:4462)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4462 advisory. - Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of...

AlmaLinux 8 : firefox (ALSA-2023:4468)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:4468 advisory. - Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of...

Mozilla: Incorrect value used during WASM compilation

The Mozilla Foundation Security Advisory describes this flaw as: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process...

Mozilla: Incorrect value used during WASM compilation

The Mozilla Foundation Security Advisory describes this flaw as: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process...

SUSE CVE-2023-4046

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

MAL-2023-1325 Malicious code in twodc-visualizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a8320b928ec8230835a771ef3d18a7751bbf07d1ea39585419f48e7d5c41a9cd The OpenSSF Package Analysis project identified 'twodc-visualizer' @ 1.6.3 npm as malicious. It is considered malicious because: - The package...

Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1117 Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

USN-6267-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. CVE-2023-4047, CVE-2023-4048,...