RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysparsemem at lysparsemem.c.

Chromium: CVE-2023-2134 Out of bounds memory access in Service Worker API

Chromium: CVE-2023-2133 Out of bounds memory access in Service Worker API

Chromium: CVE-2023-2135 Use after free in DevTools

Chromium: CVE-2023-1813 Inappropriate implementation in Extensions

Chromium: CVE-2023-1533 Use after free in WebProtect

Chromium: CVE-2023-1528 Use after free in Passwords

Chromium: CVE-2023-1532 Out of bounds read in GPU Video

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Chromium: CVE-2023-1817 Insufficient policy enforcement in Intents

Chromium: CVE-2023-1812 Out of bounds memory access in DOM Bindings

Chromium: CVE-2023-1814 Insufficient validation of untrusted input in Safe Browsing

Chromium: CVE-2023-1816 Incorrect security UI in Picture In Picture

Chromium: CVE-2023-1821 Inappropriate implementation in WebShare

Chromium: CVE-2023-1820 Heap buffer overflow in Browser History

Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.

Chromium: CVE-2023-1823 Inappropriate implementation in FedCM

Chromium: CVE-2023-1819 Out of bounds read in Accessibility

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.

A memory leak bug in jasper 3.0.6 in function cmdoptsparse.

https://github.com/jasper-software/jasper/issues/332 https://github.com/jasper-software/jasper/commit/d99636fad60629785efd1ef72da772a8ef68f54c

Impact Untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When Vec::withcapacity fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use withcapacity, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker.

This is a security concern for you, if - your server application handles untrusted websocket connections - OR your client application connects to untrusted websocket servers

Patches The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version.

Note that default memory limits are rather large (100MB dataframes and 200 MB messages), so they can still cause DoS in some environments (i.e. 32-bit). New API has been added to fine tune those limits for specific applications.

Workarounds

Migrate your project to another, maintained Websocket library like Tungstenite. Accept only trusted WebSocket traffic. Filter the WebSocket traffic though some kind of proxy that ensures sanity limits on messages. Handle process aborts gracefully and limit process memory using OS tools.

Credits This issue was reported by Evan Richter at ForAllSecure and found with Mayhem and Cargo Fuzz.

AMD. A memory corruption issue was addressed with improved input validation.

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.