🕴 Oxeye Introduce Open Source Payload Deobfuscation Tool 🕴
📖 Read
via "Dark Reading".
Ox4Shell exposes hidden payloads thatare actively being used to confuse security protection tools and security teams.📖 Read
via "Dark Reading".
Dark Reading
Oxeye Introduce Open Source Payload Deobfuscation Tool
Ox4Shell exposes hidden payloads thatare actively being used to confuse security protection tools and security teams.
‼ CVE-2021-37529 ‼
📖 Read
via "National Vulnerability Database".
A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a denial of service (context-dependent).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40565 ‼
📖 Read
via "National Vulnerability Database".
A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in av_parsers.c when using mp4box, which causes a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40566 ‼
📖 Read
via "National Vulnerability Database".
A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37530 ‼
📖 Read
via "National Vulnerability Database".
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40559 ‼
📖 Read
via "National Vulnerability Database".
A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx_parse_nal_avc function in reframe_nalu, which allows a denail of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43860 ‼
📖 Read
via "National Vulnerability Database".
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40564 ‼
📖 Read
via "National Vulnerability Database".
A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_parsers.c when using mp4box, which causes a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40563 ‼
📖 Read
via "National Vulnerability Database".
A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config function in reframe_nalu.c when using mp4box, which causes a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40562 ‼
📖 Read
via "National Vulnerability Database".
A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a denial of service.📖 Read
via "National Vulnerability Database".
⚠ Wormable Windows HTTP hole – what you need to know ⚠
📖 Read
via "Naked Security".
One bug in the January 2022 Patch Tuesday list is getting lots of attention: "HTTP Protocol Stack Remote Code Execution Vulnerability".📖 Read
via "Naked Security".
Naked Security
Wormable Windows HTTP hole – what you need to know
One bug in the January 2022 Patch Tuesday list is getting lots of attention: “HTTP Protocol Stack Remote Code Execution Vulnerability”.
‼ CVE-2022-0197 ‼
📖 Read
via "National Vulnerability Database".
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0196 ‼
📖 Read
via "National Vulnerability Database".
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30307 ‼
📖 Read
via "National Vulnerability Database".
Possible denial of service due to improper validation of DNS response when DNS client requests with PTR, NAPTR or SRV query type in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30319 ‼
📖 Read
via "National Vulnerability Database".
Possible integer overflow due to improper validation of command length parameters while processing WMI command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30301 ‼
📖 Read
via "National Vulnerability Database".
Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30330 ‼
📖 Read
via "National Vulnerability Database".
Possible null pointer dereference due to improper validation of APE clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30300 ‼
📖 Read
via "National Vulnerability Database".
Possible denial of service due to incorrectly decoding hex data for the SIB2 OTA message and assigning a garbage value to choice when processing the SRS configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30285 ‼
📖 Read
via "National Vulnerability Database".
Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30314 ‼
📖 Read
via "National Vulnerability Database".
Lack of validation for third party application accessing the service can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30313 ‼
📖 Read
via "National Vulnerability Database".
Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking📖 Read
via "National Vulnerability Database".