-
Google is aware that an exploit for CVE-2023-5217 exists in the wild but it solved in fast manner (29-09-2023)
Preface: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Background: A video codec is software or hardware that compresses and decompresses digital video. The libvpx is a…
-
CVE-2023-43642: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service! (28-09-2023)
Preface: The classes in the java. util. zip package support two widespread compression formats: GZIP and ZIP. Both of these are based on the ZLIB compression algorithm, which is discussed in RFC 1950, RFC 1951, and RFC 1952. Background: Compression Ratio: Gzip generally achieves a higher compression ratio than Snappy. If storage space is a…
-
CVE-2023-5158: Trigger Denial of service via zero-length descriptor from guest to host (27-09-2023)
Preface: In the virtio protocol, the host side provides emulation of the device, and the guest side is responsible for driving the device. The relationship between host and guest is the relationship between device and driver. We usually use the method of reading and writing temporary registers to control and drive physical devices, but for…
-
CVE-2023-42753: Missing macro could lead to a miscalculation causes memory buffer out-of-bound in Netfilter Kernel sub system . (26-09-2023)
Preface: Netfilter is an infrastructure; it is the basic API that the Linux 2.4 kernel offers for applications that want to view and manipulate network packets. Background: It can not only block unwanted traffic but also block malicious software from infecting the system. In the Linux ecosystem, iptables is a popular firewall that interfaces with…
-
XSA-273 – Xen Security Advisories (CVE-2023-34319) – Guests can trigger NIC interface reset/abort/crash via netback (24th Sep 2023)
Preface: Xen is an open-source hypervisor that allows the simultaneous development, execution, and management of multiple virtual machines on one physical computer. Xen offers two types of virtualization: paravirtualization and full virtualization. Background: XenServer is a Citrix product the company acquired from XenSource in 2007. Citrix’s XenServer provides 7 Network interface cards and 16 virtual…
-
OSIRIS-REx accomplished feat, next station is Apophis (24-09-2023)
Preface: A long-awaited asteroid sample has landed in the US, said CNN – https://edition.cnn.com/2023/09/24/world/osiris-rex-asteroid-sample-return-scn/index.html Background: Asteroid 101955 Bennu – Level 3 on the Palermo impact hazard index, a small celestial body with the highest risk of impacting the Earth. Early in the history of the solar system, the gravity of newly formed Jupiter brought an…
-
About CVE-2023-41993: The issue was addressed with improved checks for iOS and related OS products including Safari.(21-09-2023)
Preface: Perhaps this isn’t the first time this year we’ve heard of Safari and iOS having design flaws. Since both elements are close to each other. It is inevitable that it may have an impact. In addition, Safari includes open source code. So when a design flaw is discovered, sometimes the results look similar. The…
-
CVE-2023-22024: A malicious local user can crash the Unbreakable Enterprise Kernel (20-09-2023)
Preface: The Unbreakable Enterprise Kernel (UEK) is a Linux kernel built by Oracle and supported through Oracle Linux support. Reliable Datagram Sockets (RDS) is a high-performance, low-latency, reliable, connectionless protocol for delivering datagrams. It is developed by Oracle Corporation. It was included in the Linux kernel 2.6.30 which was released on 9th of June, 2009.…
-
CVE-2023-32187 : K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack (19-09-2023)
Preface: A Subject Alternate Name (or SAN) certificate is a digital security certificate which allows multiple hostnames to be protected by a single certificate. A SAN certificate may also be called a Unified Communication Certificate (or UCC), a multi-domain certificate, or an Exchange certificate. A Subject Alternative Name (SAN) certificate is capable of supporting multiple…
-
CVE-2023-4806 security focus: Corrective solution avoid glibc vulnerability occur in zero-day state (19-09-2023)
Preface: This vulnerability published on September 12, 2023. It had CVSS V3 base score 5.3. But based on the vulnerability details described, it seems it is unknown causes. But why does it happen? Background: The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other…