Chromium: CVE-2023-3422 Use after free in Guest View

Chromium: CVE-2023-3420 Type Confusion in V8

Chromium: CVE-2023-4358 Use after free in DNS

Chromium: CVE-2023-4761 Out of bounds memory access in FedCM

Chromium: CVE-2023-5485 Inappropriate implementation in Autofill

Chromium: CVE-2023-4763 Use after free in Networks

Chromium: CVE-2023-4352 Type Confusion in V8

Chromium: CVE-2023-4355 Out of bounds memory access in V8

Chromium: CVE-2023-2723 Use after free in DevTools

Chromium: CVE-2023-2724 Type Confusion in V8

Chromium: CVE-2023-2726 Inappropriate implementation in WebApp Installs

Chromium: CVE-2023-2725 Use after free in Guest View

Chromium: CVE-2023-2722 Use after free in Autofill UI

Chromium: CVE-2023-5472: Use after free in Profiles

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.

The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration).

Summary An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.

Details In dsaVerify function, it checks whether the value of the signature is legal by calling function checkValue, namely, whether r and s are both in the interval [1, q - 1]. However, the second line of the checkValue function wrongly checks the upper bound of the passed parameters, since the value of b.cmp(q) can only be 0, 1 and -1, and it can never be greater than q.

In this way, although the values of s cannot be 0, an attacker can achieve the same effect as zero by setting its value to q, and then send (r, s) = (1, q) to pass the verification of any public key.

Impact All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.

Fix PR: Since the temporary private fork was deleted, here's a webarchive of the PR discussion and diff pages: PR webarchive.zip

A deadlock issue was found in the AHCI controller device (ich9-ahci) of QEMU while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. The bug is triggered on a software reset (ahciresetport) in the handleregh2dfis() function [1]. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition.

[1] https://github.com/qemu/qemu/blob/v6.1.0-rc4/hw/ide/ahci.c#L1215

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the BadParamException thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.

MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the decompgetrddata function within the Decompress.c file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the rdlength is smaller than rdata, the result of the line Decompress.c:886 is a negative number len = rdlength - total;. This value is then passed to the decompappendbytes function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch Decompress.c:887 by breaking if(len <= 0), which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.

Chromium: CVE-2023-5473 Use after free in Cast

Last updated 24 July 2024

Chromium: CVE-2023-5477 Inappropriate implementation in Installer

Chromium: CVE-2023-5481 Inappropriate implementation in Downloads

Chromium: CVE-2023-5478 Inappropriate implementation in Autofill

Chromium: CVE-2023-5483 Inappropriate implementation in Intents

Chromium: CVE-2023-5479 Inappropriate implementation in Extensions API

Chromium: CVE-2023-4764 Incorrect security UI in BFCache