Update to prevent invalid fragment values from leading to a buffer overrun
Comment
Archive for September 7th, 2023
9 results.
Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.
Python could be made to crash or leak sensitive information if it received specially crafted input.
PLIB could be made to execute arbitrary code if it opens a specially crafted TGA file.
An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
Several security issues were fixed in Apache Shiro.
This release fixes a heap buffer overwrite in search_brace() (CVE-2023-40305) and a heap overread in lexi().
Minor security note * The DSN support added in 6.8.0 reflects the DSN back to the user in an error message if it is invalid. If a DSN uses user-supplied input (a very bad idea), it opens a distant possibility of XSS if the host app does not escape output. In an abundance of caution, malformed DSNs are no longer reflected in error messages. Changes * Don’t reflect malformed DSNs in
Update to prevent invalid fragment values from leading to a buffer overrun