CISA Issues BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces

Today, CISA issued Binding Operational Directive BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces, requiring Federal Civilian Executive Branch FCEB agencies to reduce risks posed by internet-exposed networked management interfaces on federal information systems. This...

CVE-2023-29404

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...

CVE-2023-29405

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. Flags containing...

CVE-2023-29404

The CVE-2023-29404 description is corroborated by connected advisories: it concerns the go command executing code at build time when using cgo, triggered by LDFLAGS in a #cgo LDFLAGS directive, affecting gc and gccgo. The root cause is improper handling of certain linker flags, allowing disallowe...

CVE-2023-29404 Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...

CVE-2023-29404 Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...

CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

Design/Logic Flaw

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-29539

Concrete details found: CVE-2023-29539 (Content-Disposition filename truncation on NULL) affects Firefox family and Thunderbird; root cause is NULL character in filename causing truncation and potential Reflected File Download. Connected documents (Astra Linux bulletin, Debian/CentOS advisories) ...

CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

DEBIAN-CVE-2019-19791

In LemonLDAP::NG aka lemonldap-ng before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints when some LemonLDAP::NG setup options are used. For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directive...

CVE-2019-19791

In LemonLDAP::NG aka lemonldap-ng before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints when some LemonLDAP::NG setup options are used. For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directive...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-32409 Apple Multiple Products WebKit Sandbox Escape Vulnerability CVE-2023-28204 Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability CVE-2023-323...

SUSE CVE-2023-31724

yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function dodirective at /nasm/nasm-pp.c...

CVE-2023-31724

yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function dodirective at /nasm/nasm-pp.c...

AZL-26737 CVE-2023-31724 affecting package yasm 1.3.0-17

yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function dodirective at /nasm/nasm-pp.c...

yasm 安全漏洞

yasm is a completely rewritten Netwide assembler from the yasm open source. A security vulnerability exists in yasm version 1.3.0.55.g101bc, which stems from a segmentation violation via the inclusion of the function dodirective in /nasm/nasm-pp.c. The vulnerability is caused by the inclusion of...

PT-2023-23436 · Yasm +1 · Yasm +1

Name of the Vulnerable Software and Affected Versions: yasm version 1.3.0.55.g101bc Description: A segmentation violation was discovered in yasm via the function do directive at /nasm/nasm-pp.c. Recommendations: For yasm version 1.3.0.55.g101bc, consider restricting access to the do directive...

PT-2023-6473 · Go +7 · Go +7

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.21.2 Go versions prior to 1.20.9 Description: The issue is related to the "//line" directive in the Go programming language, which can be exploited to bypass restrictions on "//go:cgo " directives. This allows blocked...