Google and Firefox fixes Zero-Day Flaw Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability, CVE-2023-5217, is actively exploited and has been patched in both Google Chrome and Firefox browsers. CVE-2023-5217 is a Heap buffer overflow vulnerability discovered in...

PT-2023-36047 · Git +1 · Liblouis

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow READ 10 crash. The crash state involves several function calls, including back passDoAction, lou...

Microsoft Edge (Chromium) < 116.0.1938.98 / 117.0.2045.47 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 116.0.1938.98 / 117.0.2045.47. It is, therefore, affected by multiple vulnerabilities as referenced in the September 29, 2023 advisory. - There exists a use after free/double free in libwebp. An attacker can use the...

Debian: Security Advisory (DLA-3588-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3598 : libvpx-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3598 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3598-1 [email protected]...

Fedora 38 : chromium (2023-d66a01ad4f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d66a01ad4f advisory. update to 117.0.5938.132. Fixes following security issues: CVE-2023-5129 CVE-2023-5186 Tenable has extracted the preceding description block directl...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : libvpx vulnerabilities (USN-6403-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6403-1 advisory. It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a speciall...

Google Chromium libvpx Heap Buffer Overflow Vulnerability

Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome...

Slackware: Security Advisory (SSA:2023-273-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OSV-2023-940 Heap-buffer-overflow in _dwarf_memcpy_swap_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62842 Crash type: Heap-buffer-overflow READ 1 Crash state: dwarfmemcpyswapbytes fillinuniarch64 dwarfmachosetup...

PT-2023-36043 · Git +1 · Libdwarf

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, as indicated by the crash type. The crash state involves functions such as dwarf memcpy swap bytes,...

Fedora 38 : libvpx (2023-c896cf87db)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c896cf87db advisory. Security fix for CVE-2023-5217 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PUB-A-264509020

In CanConvertPadV2Op of darwinnmlirconverteraidl.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

ASB-A-299477569

In BuildHuffmanTable of huffmanutils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

OSV-2023-936 Heap-buffer-overflow in Gfx::decode_bmp_pixel_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62782 Crash type: Heap-buffer-overflow READ 1 Crash state: Gfx::decodebmppixeldata Gfx::BMPImageDecoderPlugin::frame Gfx::ICOImageDecoderPlugin::loadicobitmap...

curl: CVE-2023-38545: socks5 heap buffer overflow

Vulnerability description not provided...

PT-2023-36042 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the pack unpack function, mrb pack unpack function, and mrb vm exec function...

Slackware Linux 15.0 / current libvpx Vulnerability (SSA:2023-273-01)

The version of libvpx installed on the remote host is prior to 1.12.0 / 1.13.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-273-01 advisory. - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote...

Debian DSA-5508-1 : chromium - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5508 advisory. - Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to...

GLSA-202309-15 : GNU Binutils: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202309-15 GNU Binutils: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GNU Binutils. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...