OpenSSL -- Potential NULL encryption in NID_undef with Custom Cipher

The OpenSSL project reports: Using a Custom Cipher with NIDundef may lead to NULL encryption low...

chromium -- mulitple vulnerabilities

Chrome Releases reports: This release contains 6 security fixes: 1364604 High CVE-2022-3445: Use after free in Skia. Reported by Nan Wang @eternalsakura13 and Yong Liu of 360 Vulnerability Research Institute on 2022-09-16 1368076 High CVE-2022-3446: Heap buffer overflow in WebSQL. Reported by...

roundcube-thunderbird_labels -- RCE with custom label titles

The Roundcube project reports: Description: Remote code execution vulnerability in roundcube-thunderbirdlabels when tblabelmodifylabels is enabled. Workaround: If you cannot upgrade to roundcube-thunderbirdlabels-1.4.13 disable the tblabelmodifylabels config option...

routinator -- potential DOS attack

Due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may st...

py-dparse -- REDoS vulnerability

yeisonvargasf reports: dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. Users unable to...

go -- multiple vulnerabilities

The Go project reports: archive/tar: unbounded memory consumption when reading headers Reader.Read did not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics...

strongswan -- DOS attack vulnerability

Lahav Schlesinger reported a bug related to online certificate revocation checking that can lead to a denial-of-service attack...

phpmyfaq -- CSRF vulnerability

phpmyfaq developers report: phpMyFAQ does not implement sufficient checks to avoid CSRF when logging out an user...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 3 security fixes, including: 1366813 High CVE-2022-3370: Use after free in Custom Elements. Reported by Aviv A. on 2022-09-22 1366399 High CVE-2022-3373: Out of bounds write in V8. Reported by Tibor Klajnscek on 2022-09-21...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Denial of Service via cloning an issue Arbitrary PUT request as victim user through Sentry error list Content injection via External Status Checks Project maintainers can access Datadog API Key from logs Unsafe serialization of Json data could lead to sensitive data leakage Import...

Python -- multiple vulnerabilities

Python reports: gh-97616: Fix multiplying a list by an integer list = int: detect the integer overflow when the new allocated length is close to the maximum size. Issue reported by Jordan Limor. Patch by Victor Stinner. gh-97612: Fix a shell code injection vulnerability in the...

mediawiki -- multiple vulnerabilities

Mediawiki reports: T316304, CVE-2022-41767 SECURITY: reassignEdits doesn't update results in an IP range check on Special:Contributions.. T309894, CVE-2022-41765 SECURITY: HTMLUserTextField exposes existence of hidden users. T307278, CVE-2022-41766 SECURITY: On action=rollback the message...

Python -- multiple vulnerabilities

Python reports: gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log. This is done by changing the http.server BaseHTTPRequestHandler .logmessage method to replace control characters with a \xHH hex esca...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 20 security fixes, including: 1358907 High CVE-2022-3304: Use after free in CSS. Reported by Anonymous on 2022-09-01 1343104 High CVE-2022-3201: Insufficient validation of untrusted input in Developer Tools. Reported by NDevTK on 2022-07-09 1319229...

gitea -- multiple issues

The Gitea team reports: Sanitize and Escape refs in git backend Bump golang.org/x/text Update bluemonday...

py39-joblib -- arbitrary code execution

jimlinntu reports: The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel class due to the eval statement...

unbound -- Non-Responsive Delegation Attack

A vulnerability named 'Non-Responsive Delegation Attack' NRDelegation Attack has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for...

Matrix clients -- several vulnerabilities

Matrix developers report: Two critical severity vulnerabilities in end-to-end encryption were found in the SDKs which power Element, Beeper, Cinny, SchildiChat, Circuli, Synod.im and any other clients based on matrix-js-sdk, matrix-ios-sdk or matrix-android-sdk2...

Django -- multiple vulnerabilities

Django reports: CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs...

jenkins -- XSS vulnerability

Jenkins Security Advisory: Description High SECURITY-2886 / CVE-2022-41224 Jenkins 2.367 through 2.369 both inclusive does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI. This results in a stored cross-site scripting XSS vulnerability exploitable...

redis -- Potential remote code execution vulnerability

The Redis core team reports: Executing a XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument, may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. The problem affects Redis versions 7.0.0 or newer...

zeek -- potential DoS vulnerabilities

Tim Wojtulewicz of Corelight reports: Fix a possible overflow and crash in the ICMP analyzer when receiving a specially crafted packet. Fix a possible overflow and crash in the IRC analyzer when receiving a specially crafted packet. Fix a possible overflow and crash in the SMB analyzer when...

py-tensorflow -- unchecked argument causing crash

Jingyi Shi reports: The 'AvgPoolOp' function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release includes 11 security fixes, including: 1358381 High CVE-2022-3195: Out of bounds write in Storage. Reported by Ziling Chen and Nan Wang @eternalsakura13 of 360 Vulnerability Research Institute on 2022-08-31 1358090 High CVE-2022-3196: Use after free in PDF...

expat -- Heap use-after-free vulnerability

Debian Security Advisory reports: Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed...

dendrite -- Signature checks not applied to some retrieved missing events

Dendrite team reports: Events retrieved from a remote homeserver using /getmissingevents did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events...

Grafana -- Improper authentication

Grafana Labs reports: On September 7, as a result of an internal security audit, we discovered a security vulnerability in Grafana’s basic authentication related to the usage of username and email address. n Grafana, a user’s username and email address are unique fields, which means no other user...

security/keycloak -- Multiple possible DoS attacks

CIRCL reports: CVE-2022-41966: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. CVE-2022-40151: I...

Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports: On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions. We believe...

go -- multiple vulnerabilities

The Go project reports: net/http: handle server errors after sending GOAWAY A closing HTTP/2 server connection could hang forever waiting for a clean shutdown that was preempted by a subsequent fatal error. This failure mode could be exploited to cause a denial of service. net/url: JoinPath does...

chromium -- insufficient data validation in Mojo

Chrome Releases reports: This release contains 1 security fix: 1358134 High CVE-2022-3075: Insufficient data validation in Mojo. Reported by Anonymous on 2022-08-30 Google is aware that an exploit of CVE-2022-3075 exists in the wild...

Matrix clients -- several vulnerabilities

Matrix developers report: The vulnerabilities give an adversary who you share a room with the ability to carry out a denial-of-service attack against the affected clients, making it not show all of a user's rooms or spaces and/or causing minor temporary corruption...

Gitlab -- multiple vulnerabilities

Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Content injection via Incidents Timeline description Lack of length validation in Snippets leads to Denial of Service Group IP allow-list not fully respected by the Package Registry Abusing Gitaly.GetTreeEntrie...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 24 security fixes, including: 1340253 Critical CVE-2022-3038: Use after free in Network Service. Reported by Sergei Glazunov of Google Project Zero on 2022-06-28 1343348 High CVE-2022-3039: Use after free in WebSQL. Reported by Nan Wang@eternalsakura...

FreeBSD -- zlib heap buffer overflow

Problem Description: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. Impact: Applications that call inflateGetHeader may be vulnerable to a buffer overflow. Note that inflateGetHeader is not used by anything in...

advancecomp -- Multiple vulnerabilities

GitHub advisories reports: Multiple vulnerabilities found in advancecomp including: Three segmentation faults. Heap buffer overflow via leuint32read at /lib/endianrw.h. Three more heap buffer overflows...

gitea -- multiple issues

The Gitea team reports: Remove ReverseProxy authentication from the API Support Go Vulnerability Management Forbid HTML string tooltips...

powerdns-recursor -- denial of service

PowerDNS Team reports: PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation...

zeek -- potential DoS vulnerabilities

Tim Wojtulewicz of Corelight reports: Fix a possible overflow and crash in the ARP analyzer when receiving a specially crafted packet. Due to the possibility of this happening with packets received from the network, this is a potential DoS vulnerability. Fix a possible overflow and crash in the...

rpm4 -- Multiple Vulnerabilities

rpm project reports: Fix intermediate symlinks not verified CVE-2021-35939. Fix subkey binding signatures not checked on PGP public keys CVE-2021-3521. Refactor file and directory operations to use fd-based APIs throughout CVE-2021-35938...

Gitlab -- Remote Code Execution

Gitlab reports: Remote Command Execution via Github import...

MariaDB -- Multiple vulnerabilities

The MariaDB project reports: Multiple vulnerabilities, mostly segfaults, in the server component...

gitea -- multiple issues

The Gitea team reports: Double check CloneURL is acceptable Add more checks in migration code...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 11 security fixes, including: 1349322 Critical CVE-2022-2852: Use after free in FedCM. Reported by Sergei Glazunov of Google Project Zero on 2022-08-02 1337538 High CVE-2022-2854: Use after free in SwiftShader. Reported by Cassidy Kim of Amber Securi...

dendrite -- Incorrect parsing of the event default power level in event auth

Dendrite team reports: The power level parsing within gomatrixserverlib was failing to parse the "eventsdefault" key of the m.room.powerlevels event, defaulting the event default power level to zero in all cases. In rooms where the "eventsdefault" power level had been changed, this could result i...

FreeBSD -- Memory disclosure by stale virtual memory mapping

Problem Description: A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. Impact: An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read...

varnish -- Denial of Service Vulnerability

Varnish Cache Project reports: A denial of service attack can be performed against Varnish Cache servers by specially formatting the reason phrase of the backend response status line. In order to execute an attack, the attacker would have to be able to influence the HTTP/1 responses that the...

Grafana -- Privilege escalation

Grafana Labs reports: On August 9 an internal security review identified a vulnerability in the Grafana which allows an escalation from Admin privileges to Server Admin when Auth proxy authentication is used. Auth proxy allows to authenticate a user by only providing the username or email in a...

FreeBSD -- Missing bounds check in 9p message handling

Problem Description: The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. Impact: The bug can be...

FreeBSD -- AIO credential reference count leak

Problem Description: The aioaqueue function, used by the liolistio system call, fails to release a reference to a credential in an error case. Impact: An attacker may cause the reference count to overflow, leading to a use after free UAF...