PT-2022-28183

Name of the Vulnerable Software and Affected Versions node-ipc versions 11.0.0 through 11.x Description The issue concerns a message from the maintainer being written to the user's desktop in certain versions of the software. Recommendations For node-ipc versions 11.0.0 through 11.x, review the...

CVE-2022-23812: Undefined Security Weakness

This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. Note: from versions 11.0.0 onwards, instead of having malicious code directly in the sourc...

PT-2022-28218

Name of the Vulnerable Software and Affected Versions node-ipc version 9.2.2 Description The issue concerns hidden functionality introduced by the maintainer of the node-ipc package. This functionality involves writing a file to disk that is not related to the package's intended use. It is noted...

PT-2022-16282

Name of the Vulnerable Software and Affected Versions node-ipc versions 10.1.1 through 10.1.2 Description The issue concerns malicious code embedded in the node-ipc package, targeting users with IP addresses located in Russia or Belarus. This code overwrites files with a heart emoji. The package...

node-ipc 安全漏洞

node-ipc is a node.js module from the individual developer Brandon Nozaki Miller in the United States. It is used for local and remote inter-process communication and fully supports Linux, Mac and Windows. A security vulnerability exists in node-ipc version 10.1.1 up to and including 10.1.3. The...

VulnCheck KEV: CVE-2022-23812

This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. Note: from versions 11.0.0 onwards, instead of having malicious code directly in the sourc...

Sysctls applied to containers with host IPC or host network namespaces can affect the host

Impact Before setting the sysctls for a pod, the pods namespaces must be unshared created. However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool pinns to configure the sysctls of the host. This allows a malicious user to set...

GHSA-W2J5-3RCX-VX7X Sysctls applied to containers with host IPC or host network namespaces can affect the host

Impact Before setting the sysctls for a pod, the pods namespaces must be unshared created. However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool pinns to configure the sysctls of the host. This allows a malicious user to set...

ARRIS TR3300 命令注入漏洞

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the pptpfixip, pptpfixmask, pptpfixgw, and wandns1stat parameters in the pptp function. properly filter the construct command special characters,...

Security fix for the ALT Linux 10 package thunderbird version 91.6.2-alt1

91.6.2-alt1 built March 15, 2022 Pavel Vasenkov in task 296375 March 8, 2022 Pavel Vasenkov - New version. - Security fixes: + CVE-2022-26485 Use-after-free in XSLT parameter processing + CVE-2022-26486 Use-after-free in WebGPU IPC Framework...

Oracle Linux 8 : thunderbird (ELSA-2022-0845)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0845 advisory. 91.7.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 91.7.0-2 - Update to 91.7.0 build2 91.7.0-1 - Upda...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:0824)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0824-1 advisory. - Mozilla: Use-after-free in XSLT parameter processing CVE-2022-26485 - Mozilla: Use-after-free in WebGPU IPC Framework CVE-2022-26486 - expat:...

Security fix for the ALT Linux 10 package firefox-esr version 91.6.1-alt1

91.6.1-alt1 built March 11, 2022 Pavel Vasenkov in task 296362 March 7, 2022 Pavel Vasenkov - New ESR version. - Security fixes: + CVE-2022-26485 Use-after-free in XSLT parameter processing + CVE-2022-26486 Use-after-free in WebGPU IPC Framework...

RHEL 8 : firefox (RHSA-2022:0816)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0816 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

OPENSUSE-SU-2022:0804-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 91.6.2 bsc1196809: - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework...

Mozilla: Use-after-free in WebGPU IPC Framework

An unexpected message in the WebGPU IPC framework could lead to an exploitable sandbox escape and a use-after-free issue. An attacker with enough privileges could exploit this flaw leading to a complete system compromise...

Mozilla: Use-after-free in WebGPU IPC Framework

An unexpected message in the WebGPU IPC framework could lead to an exploitable sandbox escape and a use-after-free issue. An attacker with enough privileges could exploit this flaw leading to a complete system compromise...

Critical: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Critical: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Mozilla: Use-after-free in WebGPU IPC Framework

An unexpected message in the WebGPU IPC framework could lead to an exploitable sandbox escape and a use-after-free issue. An attacker with enough privileges could exploit this flaw leading to a complete system compromise...