Daily Archives: January 30, 2024

Advisories

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

Read Time:27 Second

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More

Advisories

glibc-2.38-16.fc39

Read Time:39 Second

FEDORA-2024-aec80d6e8a

Packages in this update:

glibc-2.38-16.fc39

Update description:

Security fix for CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780.

CVE-2023-6246: __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
containing a long program name failed to update the required buffer
size, leading to the allocation and overflow of a too-small buffer on
the heap.

CVE-2023-6779: __vsyslog_internal used the return value of snprintf/vsnprintf to
calculate buffer sizes for memory allocation. If these functions (for
any reason) failed and returned -1, the resulting buffer would be too
small to hold output.

CVE-2023-6780: __vsyslog_internal calculated a buffer size by adding two integers, but
did not first check if the addition would overflow.

Read More

Advisories

glibc-2.37-18.fc38

Read Time:39 Second

FEDORA-2024-07597a0fb3

Packages in this update:

glibc-2.37-18.fc38

Update description:

Security fix for CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780.

CVE-2023-6246: __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
containing a long program name failed to update the required buffer
size, leading to the allocation and overflow of a too-small buffer on
the heap.

CVE-2023-6779: __vsyslog_internal used the return value of snprintf/vsnprintf to
calculate buffer sizes for memory allocation. If these functions (for
any reason) failed and returned -1, the resulting buffer would be too
small to hold output.

CVE-2023-6780: __vsyslog_internal calculated a buffer size by adding two integers, but
did not first check if the addition would overflow.

Read More

Advisories

xen-4.17.2-6.fc38

Read Time:17 Second

FEDORA-2024-4b2cf8c375

Packages in this update:

xen-4.17.2-6.fc38

Update description:

arm32: The cache may not be properly cleaned/invalidated (take two)
[XSA-447, CVE-2023-46837]
pci: phantom functions assigned to incorrect contexts [XSA-449,
CVE-2023-46839]
VT-d: Failure to quarantine devices in !HVM build [XSA-450,
CVE-2023-46840]

Read More

Advisories

WordPress 6.4.3 – Maintenance and Security release

Read Time:2 Minute, 10 Second

This security and maintenance release features 5 bug fixes on Core, 16 bug fixes for the Block Editor, and 2 security fixes.

Because this is a security release, it is recommended that you update your sites immediately. Backports are also available for other major WordPress releases, 4.1 and later.

You can download WordPress 6.4.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 6.4.3 is a short-cycle release. The next major release will be version 6.5 planned for 26 March 2024. You can review a summary of the maintenance updates in this release by reading the Release Candidate announcement. For further information on this release, please visit the HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

m4tuto for finding a PHP File Upload bypass via Plugin Installer (requiring admin privileges).

@_s_n_t of @pentestltd working with Trend Micro Zero Day Initiative for finding an RCE POP Chains vulnerability.

Thank you to these WordPress contributors

This release was led by Sarah Norris, Joe McGill, and Aaron Jorbin.

WordPress 6.4.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aki Hamano, Alex Concha, Alex Lende, Alex Stine, Andrea Fercia, Andrei Draganescu, Andrew Ozz, Andrew Serong, Andy Fragen, Ari Stathopoulos, Artemio Morales, ben, bobbingwide, Carlos Bravo, Carolina Nymark, Česlav Przywara, Colin Stewart, Daniel Käfer, Daniel Richards, Dominik Schilling, Ella, Erik, George Mamadashvili, Greg Ziółkowski, Isabel Brison, Joen A., John Blackbourn, Jonathan Desrosiers, joppuyo, Lax Mariappan, luisherranz, Markus, Michal Czaplinski, Mukesh Panchal, Nik Tsekouras, Niluthpal Purkayastha, Noah Allen, Pascal Birchler, Peter Wilson, ramonopoly, Riad Benguella, Sergey Biryukov, Stephen Bernhardt, Teddy Patriarca, Tonya Mork

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core and #6-5-release-leads channels. Need help? Check out the Core Contributor Handbook.

As a final reminder, The WordPress Security Team will never email you requesting that you install a plugin or theme on your site, and will never ask for an administrator username and password. Please stay vigilant against phishing attacks.

Thanks to Angela Jin, Ehtisham S., Jb Audras, and Marius L. J. for proofreading.

Read More

Advisories

USN-6609-2: Linux kernel (NVIDIA) vulnerabilities

Read Time:1 Minute, 33 Second

Lin Ma discovered that the netfilter subsystem in the Linux kernel did not
properly validate network family support while creating a new netfilter
table. A local attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2023-6040)

It was discovered that the CIFS network file system implementation in the
Linux kernel did not properly validate the server frame size in certain
situation, leading to an out-of-bounds read vulnerability. An attacker
could use this to construct a malicious CIFS image that, when operated on,
could cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-6606)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did
not properly handle inactive elements in its PIPAPO data structure, leading
to a use-after-free vulnerability. A local attacker could use this to cause
a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2023-6817)

Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf
subsystem in the Linux kernel did not properly validate all event sizes
when attaching new events, leading to an out-of-bounds write vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6931)

It was discovered that the IGMP protocol implementation in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6932)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly check deactivated elements in certain situations, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2024-0193)

Read More

Advisories

xen-4.17.2-6.fc39

Read Time:17 Second

FEDORA-2024-e527e6fd08

Packages in this update:

xen-4.17.2-6.fc39

Update description:

arm32: The cache may not be properly cleaned/invalidated (take two)
[XSA-447, CVE-2023-46837]
pci: phantom functions assigned to incorrect contexts [XSA-449,
CVE-2023-46839]
VT-d: Failure to quarantine devices in !HVM build [XSA-450,
CVE-2023-46840]

Read More