Schwachstellen, die jetzt zählen.

Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate…

Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: SMTP and POP3 response injection when using STARTTLS

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: Feed subscriptions could leak NTLM credentials on Windows

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: Calendar server credentials could be sent to an HTTP proxy

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: Attachments could be replaced with local file content when forwarding

node-forge: node-forge: Signature verification bypass via unvalidated small-order Ed25519 public keys

### Summary `ed25519.verify()` does not reject public keys of small order, such as the identity point. Under such a key, a signature with `S = 0` and a small-order `R` verifies for many messages, or for every message with the identity key, without any private key. Fixed in node-forge 1.4.3. ### Details `crypto_sign_open()` in `lib/ed25519.js` decodes the public key `A` with `unpackneg()`, which only checks that the point is on the curve, and then checks `R == [S]B - [k]A`…

node-forge: node-forge: Denial of Service via inefficient regular expression in HTTP header parsing

`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\s*$/`, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a `forge.http` client for minutes with one large response header. Fixed in node-forge 1.4.3. ### Details `_trimString()` in `lib/http.js` removes trailing whitespace with `str.replace(/\s*$/, '')`. On a string of n whitespace characters followed by a…

node-forge: node-forge: Denial of Service via unsupported TLS ServerHello compression method

### Summary A `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes `connection.process()` throw an uncaught `Error` when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details The client's ClientHello offers only the `null` compression method…

inet: reject unhashed sockets during established lookups

kernel: kernel: Denial of Service via race condition in TCP socket lookup

xen-netback: Zero out sring pointers on unmap

kernel: kernel: xen-netback: Denial of Service via double unmapping of shared data rings

xen-netback: Fix XenBus connection failure cleanup

kernel: kernel: xen-netback: Denial of Service via race condition during connection cleanup

git: Mehrere Schwachstellen

git: git: Denial of Service via binary patch size validation bypass

git: Mehrere Schwachstellen

git: git: Denial of service via commit messages with multiple GPG signatures

git: Mehrere Schwachstellen

git: git: Arbitrary file system access via fast-import features

git: Mehrere Schwachstellen

git: git: Unintended file writes via malformed unborn HEAD advertisement

git: Mehrere Schwachstellen

git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones

git: Mehrere Schwachstellen

git: git: Heap corruption via integer overflow in merge size calculations

kernel: kernel: Memory corruption via multi-register byteorder conversion in netfilter

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects. ## Announcement Announcement for this issue can be found at…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, allowing remote process memory exhaustion. ## Announcement Announcement for this issue can be found at…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Unix Negotiate authentication can accept a request when required channel-binding information is missing. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/498 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium -…