Schwachstellen, die jetzt zählen.

DSA-6605-1 chromium - security update

tag:blogger.com,1999:blog-8982037438137564684.post-37521758293263241672026-10-29T14:26:20.252-07:002026-11-03T13:29:23.627-08:00Stable Channel Update for…

DSA-6605-1 chromium - security update

tag:blogger.com,1999:blog-8982037438137564684.post-37521758293263241672026-10-29T14:26:20.252-07:002026-11-03T13:29:23.627-08:00Stable Channel Update for…

DSA-6605-1 chromium - security update

tag:blogger.com,1999:blog-8982037438137564684.post-37521758293263241672026-10-29T14:26:20.252-07:002026-11-03T13:29:23.627-08:00Stable Channel Update for…

DSA-6605-1 chromium - security update

tag:blogger.com,1999:blog-8982037438137564684.post-37521758293263241672026-10-29T14:26:20.252-07:002026-11-03T13:29:23.627-08:00Stable Channel Update for…

joserfc: joserfc: Denial of Service via unbounded recipient processing during JWE decryption

@nx/maven: @nx/gradle: Nx: Arbitrary command execution via command injection in Maven and Gradle plugins

boundary: boundary: Information disclosure via SSRF in Vault credential store integration

org.mariadb.jdbc/mariadb-java-client: mariadb-connector-j: Security feature bypass via unvalidated character set changes

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via integer truncation in length handling

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via malformed authentication response

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated packet lengths

org.mariadb.jdbc/mariadb-java-client: mariadb-java-client: Denial of Service via uncontrolled memory allocation

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information disclosure via bypass of local file validation

pypdf: pypdf: Denial of Service via crafted cross-reference streams

pypdf: pypdf: Denial of Service via forged page count in encrypted PDFs

pypdf: pypdf: Denial of Service via crafted invalid PDF dictionary

pypdf: pypdf: Denial of Service via crafted PDF page labels

pypdf: pypdf: Denial of Service via infinite loop during dictionary cloning

pypdf: pypdf: Denial of Service via excessive memory consumption during PDF parsing

pypdf: pypdf: Denial of Service via infinite loop on crafted incomplete PDF

pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding

pyasn1: pyasn1: Denial of Service via constructed bit string decoding

pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data

pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding

phpunit/phpunit: PHPUnit: Arbitrary code execution via predictable temporary directory usage

node-forge: node-forge: Denial of Service via nested ASN.1 BIT STRING decoding

### Summary `asn1.fromDer()` decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the `maxDepth` recursion limit (an incomplete fix of CVE-2025-66031) and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs (certificates, keys, PKCS structures) use excessive CPU time and memory and can abort the Node.js process. Fixed in node-forge 1.4.1. ### Details `asn1.fromDer()` attempts…

node-forge: node-forge: Server or client impersonation via improper handling of deprecated certificate extensions

node-forge: node-forge: Certificate validation bypass via unenforced path length constraints

### Summary `forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that certificate also has a `keyUsage` extension. For a CA certificate with a `pathLenConstraint` and no `keyUsage`, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1. ### Details In `pki.verifyCertificateChain()` (`lib/x509.js`), the path length check for a CA…

node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake