Chromium: CVE-2023-6351 Use after free in libavif

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

Last updated 24 July 2024

End of life: 11/26/2024, Latest version: 39

End of life: 11/26/2024, Latest version: 39

Chromium: CVE-2023-6348 Type Confusion in Spellcheck

Chromium: CVE-2023-5346 Type Confusion in V8

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

Impact

This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html.

Example:

config.addstaticview(name='static', path='/usr/src/app/static', cachemaxage=0)

And directory tree:

/usr/src/app \ | - static \ | - file.css | - index.html | - ... | - index.html <-- (this file could be disclosed with this bug)

Patches

Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.

Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:

- https://github.com/python/cpython/issues/106242 - https://github.com/python/cpython/pull/106816

At the time the following Python versions are not fixed:

- Python 3.11.0 to 3.11.4 - Python 3.12.0a1 to 3.12.0rc1

Fixes will be available in: Python 3.12.0rc2 or 3.11.5.

Please note that release candidates of Python are not production ready and should not be used for production workloads.

Workarounds

Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.

References

- https://owasp.org/www-community/attacks/PathTraversal - VN: JVN#41113329 - TN: JPCERT#93311166

Thanks

- Masashi Yamane of LAC Co., Ltd

Chromium: CVE-2023-4572 Use after free in MediaStream

Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable denial of service via local access.

Out-of-bounds read in some Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable information disclosure via local access.

Chromium: CVE-2023-4429: Use after free in Loader

Chromium: CVE-2023-4430: Use after free in Vulkan

Chromium: CVE-2023-4431: Out of bounds memory access in Fonts

A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges.

These files can include logs and system components that impact the integrity and availability of PAN-OS software.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than <textarea> as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.

A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the sandbox attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the config.iframeattributes option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the config.embedkeepOriginalContent option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.