CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 2CVE-2023-43641 – libcue vulnerable to out-of-bounds array access
https://notcve.org/view.php?id=CVE-2023-43641
libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. • http://packetstormsecurity.com/files/176128/libcue-2.2.1-Out-Of-Bounds-Access.html https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641 https://github.com/lipnitsk/libcue/commit/cfb98a060fd79dbc3463d85f0f29c3c335dfa0ea https://github.com/lipnitsk/libcue/commit/fdf72c8bded8d24cfa0608b8e97f2eed210a920e https://github.com/lipnitsk/libcue/security/advisories/GHSA-5982-x7hv-r9cj https://lists.debian.org/debian-lts-announce/2023/10/msg00018.html https://lists.fedoraproject.org/archives/l • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2023-45363
https://notcve.org/view.php?id=CVE-2023-45363
An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set. Se descubrió un problema en ApiPageSet.php en MediaWiki antes de 1.35.12, 1.36.x hasta 1.39.x antes de 1.39.5 y 1.40.x antes de 1.40.1. Permite a los atacantes provocar una denegación de servicio (bucle ilimitado y RequestTimeoutException) cuando consultan páginas redirigidas a otras variantes con redirecciones y converttitles configurados. • https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html https://phabricator.wikimedia.org/T333050 https://www.debian.org/security/2023/dsa-5520 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-45364
https://notcve.org/view.php?id=CVE-2023-45364
An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information. Se descubrió un problema en include/page/Article.php en MediaWiki 1.36.x hasta 1.39.x anteriores a 1.39.5 y 1.40.x anteriores a 1.40.1. La existencia de la revisión eliminada se filtra debido a que se verificaron permisos incorrectos. • https://phabricator.wikimedia.org/T264765 https://www.debian.org/security/2023/dsa-5520 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-39928 – webkitgtk: use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports
https://notcve.org/view.php?id=CVE-2023-39928
A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability. Existe una vulnerabilidad de use-after-free en la API MediaRecorder de Webkit WebKitGTK 2.40.5. Una página web especialmente manipulada puede aprovechar esta vulnerabilidad para provocar daños en la memoria y ejecución de código potencialmente arbitrario. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL https://security.gentoo.org/glsa/202401-33 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831 https://webkitgtk.org/security/WSA-2023-0009.html https://www.debian.org/security/2023/dsa-5527 https://access.redhat.com/security/cve/CVE-2023-39928 https://bugzilla.redhat.com/show_bug.cgi?id=2241400 • CWE-416: Use After Free •
CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 1CVE-2023-42755 – Kernel: rsvp: out-of-bounds read in rsvp_classify()
https://notcve.org/view.php?id=CVE-2023-42755
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. Se encontró una falla en el clasificador del IPv4 Resource Reservation Protocol (RSVP) en el kernel de Linux. El puntero xprt puede ir más allá de la parte lineal del skb, lo que lleva a una lectura fuera de límites en la función `rsvp_classify`. • https://access.redhat.com/errata/RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:3138 https://access.redhat.com/security/cve/CVE-2023-42755 https://bugzilla.redhat.com/show_bug.cgi?id=2239847 https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html https://seclists.org/oss-sec/2023/q3/229 • CWE-125: Out-of-bounds Read •