-
CVE-2023-20947 : About Permission Controller APK (30th March 2023)
Preface: The Android operating system is mainly based on Linux, and its kernel is written in C language. Some modifications may have been done using the C++ language. Background:Get Group State – Different software uses different way (see below): static void GetGroupState (String unionID, String zoneID = “”, String extraJson = “”) ; Vulnerability details:…
-
CVE-2022-42827 – A type confusion issue was addressed with improved checks (29th Mar 2023).
Preface: WebKitGTK is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Background: There is no Webkit. framework in Cocoa Touch. The webkit framework is only available on OS X. For iOS, just use UIWebview.The Core OS Layer is…
-
Redhat provide a quick way to do the mitigation for CVE-2023-1281 (28th Mar 2023)
Preface: Use-After-Free (UAF) is a vulnerability related to incorrect use of dynamic memory during program operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to hack the program. Background: Background: tcindex, traffic control index filter. This filter allows to match packets…
-
CVE-2023-0767: nss – Arbitrary memory write via PKCS 12 (27th Mar 2023)
Preface: During the learning process of artificial intelligence, he was always disrupted by vulnerabilities. Artificial intelligence said, to become an artificial intelligence, I will use my wisdom to create a perfect OS system. Background: Large scale of artificial intelligence structure especially machine learning may have a enterprise Linux system installed. The key component is shown…
-
Closer look CVE-2022-42331: x86 speculative vulnerability in 32bit SYSCALL path (26th Mar 2023)
Preface: Meltdown is a vulnerability allowing a process to read all memory in a given system. Background: The Xen Project is a free and open source type-1 or bare-metal hypervisor that enables a computer to run multiple operating systems simultaneously on the same hardware. A Type 1 hypervisor runs directly on the underlying computer’s physical…
-
Sometimes, cyber security incidents are caused by Java script. What type of Java script is claimed to be dangerous? (22nd Mar 2023)
Preface: Vanilla JS is faster than other frameworks. It provides better response than all other front-end frameworks. In additional, it renders UI up to 30 times faster than React JS. In Vanilla, handling UI state is simple.React is a free and open source front-end JavaScript tool library for building user interfaces based on UI components.…
-
CVE-2023-28425 : About Redis (20th Mar 2023)
Preface: The word Database, inspire you thinking a large volume of database. For example, a structured set of data held in a computer, especially one that is accessible in various ways. Do a transformation of design, bring the data which going to use to a specify memory. Compare to disk access storage, direct access to…
-
CVE-2023-0361 – About RSA ClientKeyExchange messages in GnuTLS (19th Mar 2023)
Preface: As a computer end user. When there is a vulnerability, the only way is to patch it according to the official announcement.GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language API to access the secure communications protocols.Remark: If OpenSSL is…
-
About CVE-2023-22881 and CVE-2023-22882 : malicious UDP receive by client cause a denial of service (16th Mar 2023).
Preface: Make sure to use the STUN message format specified in standard, to perform the MESSAGE-INTEGRITY computation. This protocol uses Simple Traversal of UDP through NAT (STUN) binding request and response messages for connectivity checks between the two endpoints. Background: Most attackers utilize UDP to launch amplification attacks since reflection of traffic with spoofed IP…
-
Staying alert of opensips vulnerabilities (16th Mar 2023)
Preface: SIP protocol take the stage of traditional telephony system. We cannot lack of this protocol today. Background: The Session Initiation Protocol is a signaling protocol that enables the Voice Over Internet Protocol (VoIP) by defining the messages sent between endpoints and managing the actual elements of a call. SIP supports voice calls, video conferencing,…