Schwachstellen, die jetzt zählen.

actionpack: actionpack: Session retention across logout via race condition in CacheStore

### Impact `ActionDispatch::Session::CacheStore` writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through `reset_session` on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to…

activesupport: Active Support: Cross-site scripting via MessagePack deserialization

### Impact `ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no longer `html_safe?` (for example, one mutated in place with `gsub!`) is restored as `html_safe`. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if…

activestorage: activestorage: Denial of Service via filenames containing null bytes

### Impact `ActiveStorage::Filename#base` and `#extension_with_delimiter`, and therefore `#extension`, pass the stored filename unmodified to `File.basename` and `File.extname`, which raise `ArgumentError` when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each…

actionpack: Action Pack: Web cache poisoning via improper Vary header generation during content negotiation

### Impact Action Pack negotiates the format of a rendered response from the `Accept`, `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type` request headers, but `ActionController::Rendering#_set_vary_header` adds `Vary: Accept` only when the request carries a usable `Accept` header and the response has no `Vary` header yet. A response to a request without `Accept`, or to an XHR request, therefore omits the headers that selected its representation, and a…

activestorage: Active Storage: Denial of Service via thread exhaustion from streaming storage errors

### Impact When Active Storage serves a file through its proxy controllers, `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage service by calling `head` to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and `head` replaces the response body while the server is still reading the original `ActionController::Live` buffer. That buffer is never closed, so the server thread…

python-pulpcore: pulpcore: Header content guard jq filter exposes the content-app environment

Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: SMTP and POP3 response injection when using STARTTLS

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: Feed subscriptions could leak NTLM credentials on Windows

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: Calendar server credentials could be sent to an HTTP proxy

node-forge: node-forge: Denial of Service via inefficient regular expression in HTTP header parsing

`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\s*$/`, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a `forge.http` client for minutes with one large response header. Fixed in node-forge 1.4.3. ### Details `_trimString()` in `lib/http.js` removes trailing whitespace with `str.replace(/\s*$/, '')`. On a string of n whitespace characters followed by a…

node-forge: node-forge: Denial of Service via unsupported TLS ServerHello compression method

### Summary A `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes `connection.process()` throw an uncaught `Error` when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details The client's ClientHello offers only the `null` compression method…

xen-netback: Zero out sring pointers on unmap

kernel: kernel: xen-netback: Denial of Service via double unmapping of shared data rings

xen-netback: Fix XenBus connection failure cleanup

kernel: kernel: xen-netback: Denial of Service via race condition during connection cleanup

git: Mehrere Schwachstellen

git: git: Denial of Service via binary patch size validation bypass

git: Mehrere Schwachstellen

git: git: Denial of service via commit messages with multiple GPG signatures

git: Mehrere Schwachstellen

git: git: Unintended file writes via malformed unborn HEAD advertisement

kernel: kernel: Memory corruption via multi-register byteorder conversion in netfilter

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Unix Negotiate authentication can accept a request when required channel-binding information is missing. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/498 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium -…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. `PathString.StartsWithSegments` can mishandle percent-encoded backslashes and permit authorization checks to match an unintended path. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/510 ## CVSS Details -…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A reused `ResponseBufferingStream` can retain pooled tail memory and expose response-body data from another request through HTTP logging. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/514 ## CVSS Details -…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A crafted `X-Forwarded-Prefix` can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508 ## CVSS Details -…

Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability

Windows Kernel Transaction Manager Information Disclosure Vulnerability

Windows USB Driver Elevation of Privilege Vulnerability

Windows Remote Desktop Client Information Disclosure Vulnerability

Windows Remote Desktop Client Information Disclosure Vulnerability

Windows DNS Information Disclosure Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability