Vulnerabilidades de la pila Sistemas operativos · Página 25

Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1

• Actualiza a 1:22.10.1+dfsg+~cs6.17.60671434-1

libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

• Actualiza a 1.8.4

Authlib RFC 7592 examples omit registration-access-token client binding

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception

libXtst RECORD EnableContext Reply Endless Loop

A malicious X server could send malformed  RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.

• Actualiza a 1.2.6

libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

• Actualiza a 1.8.4

Invalid pointer in the JavaScript: GC component

Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Other issue in the SVG component

Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the Graphics: Text component

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Sandbox escape due to use-after-free in the Graphics: WebRender component

Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Sandbox escape due to use-after-free in the XPCOM component

Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Race condition, use-after-free in the DOM: File component

Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Spoofing issue in the Downloads component in Firefox for Android

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the Layout: Images, Video, and HTML Frames component

Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the DOM: Animation component

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.