SUSE-SU-2023:3445-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2023-3823: Fixed an issue with external entity loading in XML without enabling it. bsc1214106 - CVE-2023-3824: Fixed a buffer overflow in phardirread. bsc1214103...

Updated php packages fix security vulnerability

Libxml - GHSA-3qrf-m4j2-pcrr Security issue with external entity loading in XML without enabling it. CVE-2023-3823 Phar - GHSA-jqcx-ccgc-xwhv Buffer mismanagement in phardirread CVE-2023-3824...

CLSA-2023-1692817457 Fix CVE(s): CVE-2023-3823, CVE-2023-3824

SECURITY UPDATE: external entity loading in XML without enabling it - debian/patches/CVE-2023-3823.patch: sanitize libxml2 globals before parsing. - CVE-2023-3823 SECURITY UPDATE: buffer mismanagement in phardirread - debian/patches/php-upstream-CVE-2023-3824.patch: fix buffer mismanagement in...

Type Confusion

nodejs is vulnerable to Type Confusion. This vulnerability exists due to a flaw in the way the Module.load API handles certain modules. An attacker is able to exploit this vulnerability to cause a type confusion error, which could lead to arbitrary code execution...

Security issue with external entity loading in XML without enabling it

...

The vulnerability of the J-Web interface in Juniper Networks Junos OS-based SRX devices allows a hacker to execute arbitrary code.

The vulnerability of the J-Web interface in Juniper Networks Junos OS-based SRX devices involves unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GHSA-GQ5F-XV48-2365 Apache XML Graphics Batik Server-Side Request Forgery vulnerability

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even...

UBUNTU-CVE-2022-44729

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even...

PT-2023-6126 · Gnu +6 · Gnu Binutils +6

Name of the Vulnerable Software and Affected Versions: GNU Binutils versions prior to 2.40 Description: The issue is related to excessive memory consumption via the load separate debug files function at dwarf2.c. An attacker could supply a crafted ELF file, potentially leading to a DNS attack. Th...

CVE-2023-32002

The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CV...

CLSA-2023-1692632368 php: Fix of 2 CVEs

CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phardirread...

CLSA-2023-1692632011 php: Fix of 2 CVEs

CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phardirread...

CLSA-2023-1692631677 php: Fix of 2 CVEs

CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phardirread...

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x 18.x and 20.x. Please note that at the time this CVE was issued the policy is an experimental feature of Node.js.

...

CVE-2023-40352

McAfee Safe Connect VPN is impacted by CVE-2023-40352 in versions prior to 2.16.1.126. The issue is a local privilege escalation via loading arbitrary DLLs caused by an uncontrolled search path element. Public sources describe the root cause as related to DLL loading configurations (one advisory ...

CVE-2023-40352: Uncontrolled Search Path Element

McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs...

CVE-2023-4387

A use-after-free flaw was found in vmxnet3rqallocrxbuf in drivers/net/vmxnet3/vmxnet3drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3rqcleanupall, which could also lead to ...

The vulnerability of the SCADA system SCADA Data Gateway (SDG) lies in its ability to load files of a dangerous type without limitation, allowing a intruder to execute arbitrary code.

The vulnerability of the SCADA system SCADA Data Gateway SDG is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

New Financial Malware 'JanelaRAT' Targets Latin American Users

Users in Latin America LATAM are the target of a financial malware called JanelaRAT that's capable of capturing sensitive information from compromised Microsoft Windows systems. "JanelaRAT mainly targets financial and cryptocurrency data from LATAM bank and financial institutions," Zscaler...