pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.63.3b17 is able to address this issue. The patch is identified as eaedaf5b10d2f7857c6b77fbf7d4a80681d4d46c. It is recommended to upgrade the affected component.

Git does not sanitize URLs when asking for credentials interactively

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit b01b9b8 which is included in release versions v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.

An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.

This issue affects LibreOffice: from 24.8 before < 24.8.4.

In the Linux kernel, the following vulnerability has been resolved:

btrfs: send: handle path ref underflow in header iterateinoderef()

Change BUGON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses.

A flaw was found in the C2 compiler in the Hotspot component of OpenJDK. C2 compilation fails with "Exceeded noderegs array" due to an improper size validation and out-of-bounds array access, potentially resulting in a corruption of the JVM memory.

Upstream OpenJDK issue: https://bugs.openjdk.org/browse/JDK-8317507

It was discovered that the C1 compiler in the Hotspot component of OpenJDK did not correctly apply an unsigned integer left shift to calculate the actual address offset under certain conditions. This could lead to an integer overflow and out-of-bounds array access, potentially corrupting the JVM memory.

A flaw was found in the Pack200 archive format in OpenJDK. The NativeUnpack class did not properly validate the memory size when allocating a buffer, potentially leading to an excessive memory allocation and denial of service condition.

A flaw was found in OpenJDK where a specially crafted long message in an Exception could lead to an application crash, resulting in a denial of service condition.

An unspecified vulnerability in Java SE related to the Networking component could allow a remote attacker to cause high integrity impact.

In the Linux kernel, the following vulnerability has been resolved:

fs/aio: Restrict kiocbsetcancelfn() to I/O submitted via libaio

If kiocbsetcancelfn() is called for I/O submitted via iouring, the following kernel warning appears:

WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocbsetcancelfn+0x9c/0xa8 Call trace: kiocbsetcancelfn+0x9c/0xa8 ffsepfilereaditer+0x144/0x1d0 ioread+0x19c/0x498 ioissuesqe+0x118/0x27c iosubmitsqes+0x25c/0x5fc arm64sysiouringenter+0x104/0xab0 invokesyscall+0x58/0x11c el0svccommon+0xb4/0xf4 doel0svc+0x2c/0xb0 el0svc+0x2c/0xa4 el0t64synchandler+0x68/0xb4 el0t64sync+0x1a4/0x1a8

Fix this by setting the IOCBAIORW flag for read and write I/O that is submitted by libaio.

wall in util-linux through 2.40 often installed with setgid tty permissions allows escape sequences to be sent to other users' terminals through argv. (Specifically escape sequences received from stdin are blocked but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

GNU Emacs could provide weaker than expected security, caused by an issue with LaTeX preview is enabled by default for e-mail attachments. A remote attacker could exploit this vulnerability to launch further attacks on the system.

CVE-2023-45145 - The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.

Upstream have released version 7.0.14/7.2.2 to fix CVE-2023-45145.

Reference: - https://github.com/redis/redis/releases/tag/7.0.14 - https://bugs.mageia.org/32406

An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attacker to cause low integrity impacts.

A flaw was found in the way the Hotspot component of OpenJDK handled array accesses in case of overflow in the index computation. This flaw could lead to an access at an invalid array position, leading to an out-of-bounds read vulnerability.

A flaw was found in the way the Hotspot component of OpenJDK handled array accesses using the binary % operator. This flaw could lead to an access at an invalid array position, leading to an out-of-bounds read vulnerability.

An unspecified vulnerability in Java SE related to the Utility component could allow a remote attacker to cause low availability impacts.

An unspecified vulnerability in Java SE related to the Networking component could allow a remote attacker to cause low integrity impacts.

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

A vulnerability was found in the pthreadcreate() function in libcap. This issue may allow a malicious actor to use cause realpthreadcreate() to return an error, which can exhaust the process memory.

Original Report:

Source: libcap2 Version: 1:2.66-3 Severity: important Tags: security upstream X-Debbugs-Cc: carnil, Debian Security Team <team.org>

The following vulnerabilities were published for libcap2.

CVE-2023-2602[0]: | LCAP-CR-23-01 (Correct the check of pthreadcreate()'s return value)

[0] https://security-tracker.debian.org/tracker/CVE-2023-2602 https://www.cve.org/CVERecord?id=CVE-2023-2602

fixed in 1:2.66-4

It was discovered that the UnixUriUtils class in the Libraries component of OpenJDK failed to sanitize strings containing slash characters when converting URIs to file system paths. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by creating Path objects with invalid paths.

A flaw was found in various components of OpenJDK in the way strings containing NULL characters were used. A specially-crafted input could lead a Java application to truncate strings incorrectly and misbehave, possibly impacting the integrity of the application.

It was discovered that the implementation of ProcesBuilder in the Libraries component of OpenJDK did not correctly process NULL characters in command name attributes. This could lead to manipulation of command arguments when executing processes with arguments from untrusted sources.

A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsockconnect of the file net/vmwvsock/afvsock.c. The manipulation leads to memory leak. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability.

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939sessiondestroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcmtxwork of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.

Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.