A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
A bug in the Linux kernel version 6.2.0 by syzkaller with our own templates. The bug causes a possible recursive locking scenario, resulting in a deadlock.
The key trace is as follows:
downread+0x9d/0x450 kernel/locking/rwsem.c:1509 dmgetinactivetable+0x2b/0xc0 drivers/md/dm-ioctl.c:773 devstatus+0x4fd/0x7c0 drivers/md/dm-ioctl.c:844 tableclear+0x197/0x280 drivers/md/dm-ioctl.c:1537
In tableclear, it acquires a write lock https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L1520 downwrite(&hashlock);
Then before the lock is released at L1539, there is a path shown above: tableclear -> devstatus -> dmgetinactivetable -> downread
https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L773 downread(&hashlock);
It tries to acquire the same read lock again, resulting in the deadlock problem
A limited SQL injection risk was identified in functionality used by the Wiki activity when listing pages.
Versions affected: 4.1 to 4.1.2, 4.0 to 4.0.7, 3.11 to 3.11.13, 3.9 to 3.9.20 and earlier unsupported versions Versions fixed: 4.1.3, 4.0.8, 3.11.14 and 3.9.21
Insufficient sanitizing of loaders used by TinyMCE resulted in an arbitrary folder creation risk.
Versions affected: 4.1 to 4.1.2 Versions fixed: 4.1.3
A vulnerability was found in Git. This security flaw occurs when renaming or deleting a section from a configuration file, where certain malicious configuration values may be misinterpreted as the beginning of a new configuration section. This flaw leads to arbitrary configuration injection.
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Chromium: CVE-2023-2137 Heap buffer overflow in sqlite
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peekforas4capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysparsemem at lysparsemem.c.
Chromium: CVE-2023-2134 Out of bounds memory access in Service Worker API
Chromium: CVE-2023-2133 Out of bounds memory access in Service Worker API
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
A slab-use-after-free read flaw was found in btrfssearchslot in fs/btrfs/ctree.c
The quota assigned ioctl can currently run in parallel with a quota disable ioctl call. The assign ioctl uses the quota root, while the disable ioctl frees that root, and therefore we can have a use-after-free triggered in the assign ioctl.
Reference: https://lore.kernel.org/linux-btrfs/35b9a70650ea947387cf352914a8774b4f7e8a6f.1679481128.git.fdmanana@suse.com/
A flaw was found in the rubygem URI. The URI parser mishandles invalid URLs that have specific characters, which causes an increase in execution time parsing strings to URI objects. This may result in a regular expression denial of service (ReDoS).
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
Chromium: CVE-2023-2135 Use after free in DevTools
Chromium: CVE-2023-1813 Inappropriate implementation in Extensions
Chromium: CVE-2023-2459 Inappropriate implementation in Prompts
Chromium: CVE-2023-1534 Out of bounds read in ANGLE
Chromium: CVE-2023-1533 Use after free in WebProtect
Chromium: CVE-2023-1528 Use after free in Passwords
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
Chromium: CVE-2023-1532 Out of bounds read in GPU Video
Chromium: CVE-2023-1811 Use after free in Frames
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Chromium: CVE-2023-1530 Use after free in PDF
Chromium: CVE-2023-2460 Insufficient validation of untrusted input in Extensions
A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.