Chromium: CVE-2023-3422 Use after free in Guest View

Chromium: CVE-2023-3420 Type Confusion in V8

GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

Chromium: CVE-2023-4358 Use after free in DNS

Chromium: CVE-2023-4761 Out of bounds memory access in FedCM

Chromium: CVE-2023-5485 Inappropriate implementation in Autofill

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

Chromium: CVE-2023-4763 Use after free in Networks

Chromium: CVE-2023-4352 Type Confusion in V8

Chromium: CVE-2023-4355 Out of bounds memory access in V8

Chromium: CVE-2023-5472: Use after free in Profiles

Summary An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.

Details In dsaVerify function, it checks whether the value of the signature is legal by calling function checkValue, namely, whether r and s are both in the interval [1, q - 1]. However, the second line of the checkValue function wrongly checks the upper bound of the passed parameters, since the value of b.cmp(q) can only be 0, 1 and -1, and it can never be greater than q.

In this way, although the values of s cannot be 0, an attacker can achieve the same effect as zero by setting its value to q, and then send (r, s) = (1, q) to pass the verification of any public key.

Impact All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.

Fix PR: Since the temporary private fork was deleted, here's a webarchive of the PR discussion and diff pages: PR webarchive.zip

An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the BadParamException thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.

BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file

Chromium: CVE-2023-5473 Use after free in Cast

Last updated 24 July 2024

Chromium: CVE-2023-5477 Inappropriate implementation in Installer

Chromium: CVE-2023-5481 Inappropriate implementation in Downloads

Chromium: CVE-2023-5478 Inappropriate implementation in Autofill

Chromium: CVE-2023-5483 Inappropriate implementation in Intents

Chromium: CVE-2023-5479 Inappropriate implementation in Extensions API

Chromium: CVE-2023-4764 Incorrect security UI in BFCache

Chromium: CVE-2023-4572 Use after free in MediaStream

Chromium: CVE-2023-4430: Use after free in Vulkan

Chromium: CVE-2023-4429: Use after free in Loader

Chromium: CVE-2023-4361 Inappropriate implementation in Autofill

Chromium: CVE-2023-4364 Inappropriate implementation in Permission Prompts