-
CVE-2023-34868 – JerryScript Design weakness (15th June 2023)
Preface: Samsung said that Open Source is not only the development method also a culture and various things. Samsung always keep in mind to give back to Open Source through their activities. They are partake in the culture of sharing and collaboration with the list of projects they have released and contributed to. Background: The…
-
CVE-2023-33142 – Does it target a similar issue? (14th June 2023)
Preface: Each SharePoint site comes with default groups and permissions.There are several options when it comes to managing permissions in SharePoint.But you should be aware somethings! Background: Default Permissions in SharePoint. By default, all SharePoint sites are created with the three security groups below:• Owners – Have full control over the site• Members – Can…
-
About CVE-2023-21656, Penguin (Linux) also want to ask question to chips vendor (13th June 2023)
Preface: The Out-of-Band vulnerabilities, also known as OOB, are a series of alternative ways that an attacker uses to exploit a vulnerability that can’t be detected by a traditional request-response interaction. Background: Qualcomm Technologies offers industry leading platforms for wireless networks and products that cover the gamut of device needs. The file (wma_mgmt[.]c) contains STA/SAP/IBSS…
-
CVE-2023-27997 Lack of detail, but can we find hints? (12th June 2023)
Preface: If you need to push audio/video traffic over the tunnel DTLS can be a huge performance improvement. Background: Preferred DTLS TunnelIf enabled, FortiClient uses DTLS if it is enabled on the FortiGate and tunnel establishment is successful. If not enabled on the FortiGate or tunnel establishment does not succeed, TLS is used. DTLS tunnel…
-
About CVE-2023-21632: Flaw has been fixed. For reference only (12th June 2023)
Preface: Google (Android) and Qualcomm pioneer empower the infotainment and connectivity processors for automotive. As times goes by, when you jump to driver seat, a multifucntion dsahboard can provide functions to you.In-car entertainment or in-vehicle infotainment systems are large touch screens usually positioned on a vehicle’s dashboard or on the back of seats. Background: The…
-
CVE-2023-29403: Are you falling into this Go runtime design weakness? (9th June 2023)
Preface: Go is garbage collected instead of manual memory management which is not suitable for a kernel.Golang is useful for carrying out programming for scalable servers and large software systems. The Golang programming language was built to fill in the gaps of C++ and Java that Google came across while working with its servers and…
-
More details, CVE-2023-0266 vulnerability is widely exploited (8th June 2023)
Preface: The Advanced Linux Sound Architecture (ALSA) provides kernel driven sound card drivers.Besides the sound device drivers, ALSA also bundles a user space driven library for application developers. This enables direct (kernel) interaction with sound devices through ALSA libraries. Background: Exynos, formerly Hummingbird, is a series of ARM-based system-on-chips developed by Samsung Electronics’ System LSI…
-
About Qualcomm: The vulnerability of CVE-2022-40507 release to public on 06/06/2023 finally.
Preface: Double free errors occur when free() is called more than once with the same memory address as an argument. Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program’s memory management data structures become corrupted and could allow a malicious…
-
Regarding CVE-2023-3111: Fixed a functional bug that could affect Linux in Docker. (June 6, 2023)
Preface: Use-After-Free (UAF) is a vulnerability related to incorrect use of dynamic memory during program operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to hack the program. Background: Btrfs provides a clone operation that atomically creates a copy-on-write snapshot of…
-
About CVE-2023-29345 and CVE-2023-33143, Microsoft released Security Updated of the Chromium project (6th June 2023)
Preface: Windows has traditionally run on machines that are powered by x86 / x64 processors. Windows 11 adds the capability to run unmodified x64 Windows apps on Arm devices! This capability to run x86 & x64 apps on Arm devices gives end-users confidence that the majority of their existing apps & tools will run well…