Schwachstellen, die jetzt zählen.

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

DSA-6607-1 apt - security update

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the…

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

openusd: openusd: Arbitrary code execution via double-free in crate file parsing

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the…

libwebsockets: libwebsockets: arbitrary code execution via crafted MQTT PUBACK packets

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated…

mlflow: mlflow: Arbitrary code execution via untrusted SHAP model deserialization

mlflow: mlflow: Arbitrary code execution via untrusted data deserialization in PickleEvaluationArtifact

Red Hat Enterprise Linux: Mehrere Schwachstellen

perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits

Red Hat Enterprise Linux: Mehrere Schwachstellen

perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

Red Hat Enterprise Linux: Mehrere Schwachstellen

perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames

perl-cgi: perl-cgi: Denial of Service via unescaped cookie expiration attribute

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as…

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to…

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld).

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment…

Ovation: Ovation: Arbitrary code execution via unverified firmware updates

Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.

kore: kore: Denial of Service via integer underflow in HTTP request body handling

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog.

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.

github.com/moby/buildkit: BuildKit: Privilege escalation via unauthorized extended file attribute modification

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in…

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on…

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages.

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a…

@angular/router: @angular/router: Denial of Service via query parameter memory retention during server-side rendering

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled…

@angular/router: @angular/router: Denial of Service via improper route outlet matching in Server-Side Rendering

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate…

Google Chrome / Microsoft Edge: Mehrere Schwachstellen

tag:blogger.com,1999:blog-8982037438137564684.post-8817060464324319472026-11-03T12:38:18.791-08:002026-11-10T15:24:39.839-08:00Stable Channel Update for…

Google Chrome / Microsoft Edge: Mehrere Schwachstellen

tag:blogger.com,1999:blog-8982037438137564684.post-8817060464324319472026-11-03T12:38:18.791-08:002026-11-10T15:24:39.839-08:00Stable Channel Update for…

Google Chrome / Microsoft Edge: Mehrere Schwachstellen

tag:blogger.com,1999:blog-8982037438137564684.post-8817060464324319472026-11-03T12:38:18.791-08:002026-11-10T15:24:39.839-08:00Stable Channel Update for…