Chromium: CVE-2023-6351 Use after free in libavif

Last updated 24 July 2024

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.

Chromium: CVE-2023-5472: Use after free in Profiles

Chromium: CVE-2023-5346 Type Confusion in V8

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

Impact

This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html.

Example:

config.addstaticview(name='static', path='/usr/src/app/static', cachemaxage=0)

And directory tree:

/usr/src/app \ | - static \ | - file.css | - index.html | - ... | - index.html <-- (this file could be disclosed with this bug)

Patches

Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.

Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:

- https://github.com/python/cpython/issues/106242 - https://github.com/python/cpython/pull/106816

At the time the following Python versions are not fixed:

- Python 3.11.0 to 3.11.4 - Python 3.12.0a1 to 3.12.0rc1

Fixes will be available in: Python 3.12.0rc2 or 3.11.5.

Please note that release candidates of Python are not production ready and should not be used for production workloads.

Workarounds

Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.

References

- https://owasp.org/www-community/attacks/PathTraversal - VN: JVN#41113329 - TN: JPCERT#93311166

Thanks

- Masashi Yamane of LAC Co., Ltd

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

Chromium: CVE-2023-4572 Use after free in MediaStream

Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable denial of service via local access.

Out-of-bounds read in some Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable information disclosure via local access.

A heap out of bounds memory read was found in the virtual nvme device in QEMU. An offset provided by guest is not validated by qemu process before computing a host heap pointer, which is used for copying data back to guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

ZDI security advisory: https://www.zerodayinitiative.com/advisories/ZDI-CAN-21521

Upstream patch: https://lists.nongnu.org/archive/html/qemu-devel/2023-08/msg00516.html

Chromium: CVE-2023-4429: Use after free in Loader

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width height) appearing to be zero.

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.

Chromium: CVE-2023-4430: Use after free in Vulkan

Chromium: CVE-2023-4431: Out of bounds memory access in Fonts

Chromium: CVE-2023-4355 Out of bounds memory access in V8

Chromium: CVE-2023-4367 Insufficient policy enforcement in Extensions API

Chromium: CVE-2023-4358 Use after free in DNS

Chromium: CVE-2023-4361 Inappropriate implementation in Autofill

Chromium: CVE-2023-4360 Inappropriate implementation in Color

Chromium: CVE-2023-4349 Use after free in Device Trust Connectors

Chromium: CVE-2023-4353 Heap buffer overflow in ANGLE

Chromium: CVE-2023-4073 Out of bounds memory access in ANGLE

Chromium: CVE-2023-4350 Inappropriate implementation in Fullscreen

Chromium: CVE-2023-4352 Type Confusion in V8

Chromium: CVE-2023-4366 Use after free in Extensions

Chromium: CVE-2023-4356 Use after free in Audio