CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

Security Vulnerabilities fixed in Firefox 109 — Mozilla

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. Due to the Firefox GTK wrapper...

GSD-2022-1006420 sch_sfb: Don't assume the skb is still around after enqueueing to child

schsfb: Don't assume the skb is still around after enqueueing to child This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.213 by commit...

PT-2022-34677 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 2.6.39 through 5.4.212 Description: The issue is related to a potential security problem in the Linux Kernel, where it is assumed that a certain packet skb remains available after being added to a queue for a child...

GHSA-G2C3-VWFF-M3XR Font-Converter Vulnerable to Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...

Font-Converter Vulnerable to Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...

CVE-2022-21165

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

CVE-2022-21165 Arbitrary Command Injection

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

CVE-2022-21165

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

node-js-font-converter 安全漏洞

node-js-font-converter is a FontForge wrapper for zgec individual developers. It allows conversion between different font formats TTF, WOFF, OTF. A security vulnerability exists in all versions of the node-js-font-converter package, which stems from a lack of sanitization of input that may be...

Malicious code in uplex-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8368b463b71f466eecd3d878bec93228d62f8ea08c428859cd8ba850d292543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in duplex-child-rocess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b3ec325a6dc92f083b06d506e89526c20430b1740c4af5e7d3df470e48c455f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in duplex-child-orocess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d80c9a50168c6e1e994ec5162bc0269e152ff4c19a7341943ecde6cd1574a2ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2614 Malicious code in duplex-child-orocess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d80c9a50168c6e1e994ec5162bc0269e152ff4c19a7341943ecde6cd1574a2ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2615 Malicious code in duplex-child-rocess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b3ec325a6dc92f083b06d506e89526c20430b1740c4af5e7d3df470e48c455f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6813 Malicious code in uplex-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8368b463b71f466eecd3d878bec93228d62f8ea08c428859cd8ba850d292543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF Affected versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC ...

NodePDF 命令注入漏洞

NodePDF is a PDF rendering tool based on Node.js. A security vulnerability exists in NodePDF version 1.3.0, which stems from the fact that during PDF rendering, input passed to the Pdf function is escaped by the shell and passed to childprocess.exec. However, shell escaping does not correctly...

GHSA-WF5X-CR3R-XR77 vm2 before 3.6.11 vulnerable to sandbox escape

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

CVE-2019-10761 Sandbox Bypass

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...