6624 matches found
dnsmasq -- heap use-after-free in dhcp6_no_relay
Petr MenÅ¡Ãk reports: Possible vulnerability ... found in latest dnsmasq. It was found with help of oss-fuzz Google project by me and short after that independently also by Richard Johnson of Trellix Threat Labs. It is affected only by DHCPv6 requests, which could be crafted to modify already free...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 28 security fixes, including: 1292261 High CVE-2022-1125: Use after free in Portals. Reported by Khalil Zhani on 2022-01-29 1291891 High CVE-2022-1127: Use after free in QR Code Generator. Reported by anonymous on 2022-01-28 1301920 High CVE-2022-112...
chromium -- V8 type confusion
Chrome Releases reports: This release contains 1 security fix: 1309225 High CVE-2022-1096: Type Confusion in V8. Reported by anonymous on 2022-03-23 Google is aware that an exploit for CVE-2022-1096 exists in the wild...
powerdns -- denial of service
PowerDNS Team reports: PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor...
powerdns-recursor -- denial of service
PowerDNS Team reports: PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor...
e2fsprogs -- out-of-bounds read/write vulnerability
Nils Bars reports: During the processing of a specially fuzzed disk image, an out-of-bounds write is triggered and causes a segmentation fault SIGSEGV...
gitea -- Open Redirect on login
Andrew Thornton reports: When a location containing backslashes is presented, the existing protections against open redirect are bypassed, because browsers will convert adjacent forward and backslashes within the location to double forward slashes...
mitmproxy -- Insufficient Protection against HTTP Request Smuggling
Zeyu Zhang reports: In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body...
py-nicotine-plus -- Denial of service vulnerability
ztauras reports: Denial of service DoS vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...
FreeBSD-kernel -- Multiple WiFi issues
Problem Description: The paper "Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation" reported a number of security vulnerabilities in the 802.11 specification related to frame aggregation and fragmentation. Additionally, FreeBSD 12.x missed length validation of SSIDs an...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 11 security fixes, including: 1299422 Critical CVE-2022-0971: Use after free in Blink Layout. Reported by Sergei Glazunov of Google Project Zero on 2022-02-21 1301320 High CVE-2022-0972: Use after free in Extensions. Reported by Sergei Glazunov of...
OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates
The OpenSSL project reports: Infinite loop in BNmodsqrt reachable when parsing certificates High The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that...
Apache httpd -- Multiple vulnerabilities
The Apache httpd project reports: modlua: Use of uninitialized value of in r:parsebody moderate CVE-2022-22719A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. HTTP request smuggling vulnerability important CVE-2022-22720 httpd fails...
Weechat -- Possible man-in-the-middle attack in TLS connection to servers
The Weechat project reports: After changing the options weechat.network.gnutlscasystem or weechat.network.gnutlscauser, the TLS verification function is lost. Consequently, any connection to a server with TLS is made without verifying the certificate, which could lead to a man-in-the-middle attac...
kafka -- Denial Of Service vulnerability
NIST reports: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...
wordpress -- multiple issues
wordpress developers reports: This security and maintenance release features 1 bug fix in addition to 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated. The security team would li...
openvpn -- Potential authentication by-pass with multiple deferred authentication plug-ins
David Sommerseth reports: OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials...
py-httpie -- exposure of sensitive information vulnerabilities
Glyph reports: HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn't distinguish between...
gitea -- Improper/incorrect authorization
Youssef Rebahi-Gilbert reports: When Gitea is built and configured for PAM authentication it skips checking authorization completely. Therefore expired accounts and accounts with expired passwords can still login...
asterisk -- multiple vulnerabilities
The Asterisk project reports: AST-2022-004 - The header length on incoming STUN messages that contain an ERROR-CODE attribute is not properly checked. This can result in an integer underflow. Note, this requires ICE or WebRTC support to be in use with a malicious remote party. AST-2022-005 - When...
py-Scrapy -- exposure of sensitive information vulnerability
ranjit-git reports: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 28 security fixes, including: 1289383 High CVE-2022-0789: Heap buffer overflow in ANGLE. Reported by SeongHwan Park SeHwa on 2022-01-21 1274077 High CVE-2022-0790: Use after free in Cast UI. Reported by Anonymous on 2021-11-26 1278322 High...
py-Scrapy -- cookie injection vulnerability
Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses from example.co.uk, given its public domain name suffix is co.uk are able to set cookies that are included in requests to any other domain sharing the same domain name suffix...
Apache OpenOffice -- master password vulnerabilities
The Apache Openoffice project reports: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization...
Gitlab -- multiple vulnerabilities
Gitlab reports: Runner registration token disclosure through Quick Actions Unprivileged users can add other users to groups through an API endpoint Inaccurate display of Snippet contents can be potentially misleading to users Environment variables can be leaked via the sendmail delivery method...
typo3 -- XSS vulnerability in svg-sanitize
The TYPO3 project reports: The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+x...
seatd-launch -- remove files with escalated privileges with SUID
Kenny Levinsen reports: seatd-launch could use a user-specified socket path instead of the internally generated socket path, and would unlink the socket path before use to guard against collision with leftover sockets. This meant that a caller could freely control what file path would be unlinked...
flac -- fix encoder bug
The FLAC 1.3.4 release reports: Fix 12 decoder bugs found by oss-fuzz. Fix encoder bug CVE-2021-0561...
Qt5 -- QProcess unexpected search path
The Qt Company reports: Recently, the Qt Project's security team was made aware of an issue regarding QProcess and determined it to be a security issue on Unix-based platforms only. We do not believe this to be a considerable risk for applications as the likelihood of it being triggered is minima...
gitea -- password hash quality
The Gitea team reports: This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters. In addition it takes the opportunity to adjust the settings for pbkdf2 in order to make the hashing a little...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 11 security fixes, including: 1290008 High CVE-2022-0603: Use after free in File Manager. Reported by Chaoyuan Peng @ret2happy on 2022-01-22 1273397 High CVE-2022-0604: Heap buffer overflow in Tab Groups. Reported by Krace on 2021-11-24 1286940 High...
zsh -- Arbitrary command execution vulnerability
Marc Cornellà reports: Some prompt expansion sequences, such as %F, support 'arguments' which are themselves expanded in case they contain colour values, etc. This additional expansion would trigger PROMPTSUBST evaluation, if enabled. This could be abused to execute code the user didn't expect...
MariaDB -- Multiple vulnerabilities
MariaDB reports: MariaDB reports 5 vulnerabilities in supported versions resulting from fuzzing tests...
cassandra3 -- arbitrary code execution
Marcus Eriksson reports: When running Apache Cassandra with the following configuration: enableuserdefinedfunctions: true enablescripteduserdefinedfunctions: true enableuserdefinedfunctionsthreads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need...
go -- multiple vulnerabilities
The Go project reports: crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates Some big.Int values that are not valid field elements negative or overflowing might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid...
MariaDB -- Multiple vulnerabilities
MariaDB reports: MariaDB reports 5 vulnerabilities in supported versions without further detailed information...
jenkins -- DoS vulnerability in bundled XStream library
Jenkins Security Advisory: Description Medium SECURITY-2602 / CVE-2021-43859 upstream issue, CVE-2022-0538 Jenkins-specific converters DoS vulnerability in bundled XStream library...
go -- multiple vulnerabilities
The Go project reports: regexp: stack exhaustion compiling deeply nested expressions On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2...
py-twisted -- cookie and authorization headers are leaked when following cross-origin redirects
Twisted developers report: Cookie and Authorization headers are leaked when following cross-origin redirects in twited.web.client.RedirectAgent and twisted.web.client.BrowserLikeRedirectAgent...
cyrus-sasl -- Escape password for SQL insert/update commands
Cyrus SASL 2.1.x Release Notes New in 2.1.28 reports: Escape password for SQL insert/update commands...
Gitlab -- multiple vulnerabilities
Gitlab reports: Arbitrary POST requests via special HTML attributes in Jupyter Notebooks DNS Rebinding vulnerability in Irker IRC Gateway integration Missing certificate validation for external CI services Blind SSRF Through Project Import Open redirect vulnerability in Jira Integration Issue lin...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 27 security fixes, including: 1284584 High CVE-2022-0452: Use after free in Safe Browsing. Reported by avaue at S.S.L. on 2022-01-05 1284916 High CVE-2022-0453: Use after free in Reader Mode. Reported by Rong Jian of VRI on 2022-01-06 1287962 High...
py-treq -- sensitive information leak vulnerability
Treq's request methods treq.get, treq.post, HTTPClient.request, HTTPClient.get, etc. accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to every domain "supercookies". This can potentially cause sensitive information to leak upon an HTTP redirect...
samba -- Multiple Vulnerabilities
The Samba Team reports: CVE-2021-43566: Malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the...
OpenSSL -- BN_mod_exp incorrect results on MIPS
The OpenSSL project reports: BNmodexp may produce incorrect results on MIPS Moderate There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the...
Security Vulnerability found in ExifTool leading to RCE
Debian Security tracker reports: ExifTool.pm in ExifTool before 12.38 mishandles a file special characters check, leading to command injection...
varnish -- Request Smuggling Vulnerability
Varnish Cache Project reports: A request smuggling attack can be performed on HTTP/1 connections on Varnish Cache servers. The smuggled request would be treated as an additional request by the Varnish server, go through normal VCL processing, and injected as a spurious response on the client...
polkit -- Local Privilege Escalation
Qualys reports: We discovered a Local Privilege Escalation from any user to root in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution...
xrdp -- privilege escalation
xrdp project reports: An integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is accessible to a sesman server listens by default on localhost when installing xrdp, but can be remote if configured otherwise to execute code as root...