Read Time:5 Second
Felix Wilhelm discovered that the containerd container runtime was
susceptible to information disclosure via malformed container images.
Category Archives: Advisories
DSA-5090 firefox-esr – security update
Read Time:6 Second
Two security issues have been found in the Mozilla Firefox web browser,
which result in the execution of arbitrary code.
AST-2022-006: pjproject: unconstrained malformed multipart SIP message
Read Time:11 Second
Posted by Asterisk Security Team on Mar 04
Asterisk Project Security Advisory – AST-2022-006
Product Asterisk
Summary pjproject: unconstrained malformed multipart SIP
message
Nature of Advisory Out of bounds memory access
Susceptibility Remote unauthenticated sessions…
AST-2022-005: pjproject: undefined behavior after freeing a dialog set
Read Time:11 Second
Posted by Asterisk Security Team on Mar 04
Asterisk Project Security Advisory – AST-2022-005
Product Asterisk
Summary pjproject: undefined behavior after freeing a dialog
set
Nature of Advisory Denial of service
Susceptibility Remote unauthenticated sessions…
AST-2022-004: pjproject: integer underflow on STUN message
Read Time:11 Second
Posted by Asterisk Security Team on Mar 04
Asterisk Project Security Advisory – AST-2022-004
Product Asterisk
Summary pjproject: possible integer underflow on STUN
message
Nature of Advisory Arbitrary code execution
Susceptibility Remote unauthenticated sessions…
CVE-2021-20319
Read Time:17 Second
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
CVE-2021-20300
Read Time:13 Second
A flaw was found in OpenEXR’s hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.
CVE-2021-20302
Read Time:13 Second
A flaw was found in OpenEXR’s TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
CVE-2021-20303
Read Time:18 Second
A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.
CVE-2021-23214
Read Time:13 Second
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.