FBI confirms Barracuda patch is not effective for exploited ESG appliances

In an FBI Flash about a Barracuda ESG vulnerability, listed as CVE-2023-2868, the FBI has stated that the patches released by Barracuda in response to this CVE were ineffective for anyone previously infected. Although both Barracude and Mandiant have already made this determination, the agency sa...

The vulnerability of the `write_status_text_and_buffer` function in the `prc.c` component of the GnuPG information encryption and digital signatures generation program allows a perpetrator to access confidential data and compromise its integrity.

The vulnerability of the writestatustextandbuffer function in the prc.c component of the GnuPG information encryption and digital signatures generation program involves insufficient elimination of special elements in the request. Exploiting this vulnerability allows a malicious actor to gain acce...

Barracuda Email Security Gateway < 9.2.0.008 Command Injection (CVE-2023-2868)

According to its self-reported version, the Barracuda Email Security Gateway on the remote web server is 9.2.0.008. It is, therefore, affected by a command injection vulnerability in the processing of .tar files that could allow a remote, unauthenticated attacker to execute arbitrary commands wit...

Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

Summary This joint Cybersecurity Advisory CSA provides the top Common Vulnerabilities and Exposures CVEs used since 2020 by People’s Republic of China PRC state-sponsored cyber actors as assessed by the National Security Agency NSA, Cybersecurity and Infrastructure Security Agency CISA, and Feder...

Pro-China Group Uses Dragonbridge Campaign to Target Rare Earth Mining Companies

A pro-China influence campaign singled out rare earth mining companies in Australia, Canada, and the U.S. with negative messaging in an unsuccessful attempt to manipulate public discourse to China's benefit. Targeted firms included Australia's Lynas Rare Earths Ltd, Canada's Appia Rare Earths &...

People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Summary Best Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China PRC state-sponsored...

CVE-2021-44046

An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function verifying input data from a U3D file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the conte...

CVE-2021-44046

An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function verifying input data from a U3D file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the conte...

CVE-2021-44046

An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function verifying input data from a U3D file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the conte...

Out-of-bounds

An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function verifying input data from a U3D file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the conte...

CVE-2021-44046

An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function verifying input data from a U3D file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the conte...

CVE-2021-44046

The CVE-2021-44046 entry corresponds to an out-of-bounds write vulnerability in Open Design Alliance’s PRC SDK (pre-2022.11) triggered by parsing U3D files, caused by an unchecked return value while verifying U3D data. Public connected sources identify exploitation against affected components suc...

CVE-2021-44046: Out-of-bounds Write

An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function verifying input data from a U3D file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the conte...

PT-2021-24032

Name of the Vulnerable Software and Affected Versions: Open Design Alliance PRC SDK versions prior to 2022.11 Description: An out-of-bounds write issue exists when reading U3D files, caused by an unchecked return value of a function that verifies input data from a U3D file. This allows an attacke...

CVE-2021-43581

An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the parsing of U3D files. Incorrect use of the LibJpeg source manager inside the U3D library, and crafted data in a U3D file, can trigger a read...

CVE-2021-43581

An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the parsing of U3D files. Incorrect use of the LibJpeg source manager inside the U3D library, and crafted data in a U3D file, can trigger a read...

CVE-2021-43581

Open Design Alliance PRC SDK (and related ODAViewer components handling U3D) is affected by an Out-of-Bounds Read in the U3D file parser. The root cause is the incorrect use of the LibJpeg source manager inside the U3D library, with crafted U3D data triggering a read past the end of an allocated ...

CVE-2021-43581: Out-of-bounds Read

An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the parsing of U3D files. Incorrect use of the LibJpeg source manager inside the U3D library, and crafted data in a U3D file, can trigger a read...

PT-2021-23885

Name of the Vulnerable Software and Affected Versions Open Design Alliance PRC SDK versions prior to 2022.11 Description The issue exists within the parsing of U3D files, specifically due to the incorrect use of the LibJpeg source manager inside the U3D library. Crafted data in a U3D file can...

CVE-2021-43279

An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute...