-
CVE-2023-4813 – A flaw was found in glibc (13th Sep 2023)
Preface: Technicians tend to focus on zero-day vulnerability status. Makes sense. However, the computer world expands from workstations and intranets into the IoT world. The Internet of Things master put the workstation project into the IoT catalog early on. At the same time, software includes operating system platform and programming language design, and is not…
-
CVE-2023-41064: Design weakness in iOS and macOS – Processing a maliciously crafted image may lead to arbitrary code execution (Released September 11, 2023).
Preface: Apple releases new iOS 15.7.9 and 16.6.1update for iPhone. iOS 15.7.9 and 16.6.1 like many of its predecessors, is a point upgrade and it patches up a security issue. But it doesn’t provides bug fixes technical details! Background: The Core Graphics framework is based on the Quartz advanced drawing engine. It provides low-level, lightweight…
-
Cumulus Linux design limitation: CVE-2023-25525 (11th Sep 2023)
Preface: When technology world relies on cloud computing. Meanwhile fast switching includes high speed backbone will be counted. The technology shift physical network device go to virtual computing platform. That said, the traditional design goal one software installs to one hardware unit. For instance, a single operating system install on one hardware device has been…
-
A closer look at Samsung’s CVE-2023-40353 (8th Sep 2023)
Preface: CWE-125 Out-of-Bounds Read is a type of software error that can occur when reading data from memory. This can happen if the program tries to read beyond the end of an array, for example. Out of bounds reads can lead to crashes or other unexpected vulnerabilities, and may allow an attacker to read sensitive…
-
About Redis – CVE-2023-41053 (8th Sep 2023)
Preface: Redis is a standard key-value store, like a dictionary, containing multiple keys, each with its unique value that can be retrieved or pinned. It is similar to a data structure server that relies on various key values. Redis has built-in replica functionality. It can hold keys to 512MB. Background: The Redis SORT_RO command is…
-
CVE-2023-28543 – Out of Bounds read in SNPE Library (5th Sep 2023)
Preface: The Qualcomm Neural Processing SDK is designed to help developers run one or more neural network models trained in TensorFlow, PyTorch,… Background: Deep neural network (DNN) models can address these limitations of matrix factorization. DNNs can easily incorporate query features and item features (due to the flexibility of the input layer of the network),…
-
CVE-2023-38468 and CVE-2023-38467 related to urlid, whether the design limitation found by UNISOC chip is correlate to java matter? (4th Sep 2023)
Preface: The first-level (L1) cache is small enough to provide a one- or two-cycle access time. The second-level (L2) cache is also built from SRAM but is larger, and therefore slower, than the L1 cache. The processor first looks for the data in the L1 cache. If the L1 cache misses, the processor looks in…
-
CVE-2023-20851: Out-of-bounds read in stc (4th Sep 2023)
Preface: Xiaomi and Samsung are MediaTek’s biggest clients Background: MediaTek 8188 (MT8188) is a 64-bit ARM SoC introduced by MediaTek in 2022. The chip incorporates eight cores – six Cortex-A55 little cores and two Cortex-A78. Cortex-A78 can operate at up to 2.6 GHz. Cortex-A55 can operate at up to 2.0 GHz. STC(Store Coprocessor Registers) writes…
-
CVE‑2023‑25528 and CVE‑2023‑25533: A cough in Artificial Intelligence world!
(1st Sep 2023) Preface: AI (Artificial intelligence) moves from big data normalization to learning to understand data, so called trained. It require large amount of computer processing resources. The machine learning process requires CPUs and GPUs. GPUs are used to train large deep learning models, while CPUs are good for data preparation, feature extraction, and…
-
CVE-2023-20900 – Does SAML token signing bypass happen this way? (31-08-2023)
Preface: The easier way to get the SAML token is directly through the UserSession you can access in your Java plugin. UserSession has a samlTokenXml field. Then you can use the SSO API to convert that xml into the SAML token object. Background: VMware Tools is a set of services and modules that enable several…