CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...

CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...

CVE-2024-32477

The CVE-2024-32477 vulnerability affects Deno versions prior to 1.42.2, caused by a race between ANSI escape sequences (e.g., ) and reading standard input. This allows an attacker to manipulate the permission prompt and bypass the permission policy via the PTY channel. Several connected sourc...

CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...

USN-6737-1 glibc vulnerability

Charles Fol discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code...

PT-2024-3679 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 1.42.2 Description: The issue is caused by errors in synchronization when using a shared resource in the Deno runtime environment for JavaScript and TypeScript. Exploitation of this issue may allow an attacker to disclo...

Deno 安全漏洞

Deno is open source for a simple, modern and secure JavaScript and TypeScript runtime environment. It uses V8 and is built with Rust. A security vulnerability exists in versions prior to Deno 1.42.2, which stems from a race condition between an ANSI escape sequence and reading standard input,...

Ubuntu: Security Advisory (USN-6735-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2024-1383 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically,...

Ubuntu: Security Advisory (USN-6719-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6719-2 util-linux vulnerability

USN-6719-1 fixed a vulnerability in util-linux. Unfortunately, it was discovered that the fix did not fully address the issue. This update removes the setgid permission bit from the wall and write utilities. Original advisory details: Skyler Ferrante discovered that the util-linux wall command di...

SUSE SLES15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2024:1169-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1169-1 advisory. - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831 Tenable has extracted the preceding description block directly fr...

Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : util-linux vulnerability (USN-6719-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6719-2 advisory. USN-6719-1 fixed a vulnerability in util-linux. Unfortunately, it was discovered that the fix did not fully address the issue. This update...

SUSE SLED15: libblkid-devel / libblkid-devel-32bit / libblkid-devel-static / etc (SUSE-SU-2024:1172-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1172-1 advisory. - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831 Tenable has extracted the...

SUSE SLES15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2024:1170-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1170-1 advisory. - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831 Tenable has extracted the preceding description block directly fr...

SUSE-SU-2024:1171-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831...

SUSE-SU-2024:1169-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831...

SUSE SLES15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2024:1106-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1106-1 advisory. - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831 - Prevent error message if /var/lib/libuuid/clock.txt does not...

MGASA-2024-0112 Updated util-linux packages fix security vulnerability

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked. There may be plausible...

Updated util-linux packages fix security vulnerability

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked. There may be plausible...