Agustin Gianni

**Name of the Vulnerable Software and Affected Versions** HyperKit versions 0.20210107 and prior **Description** The issue is related to a buffer overflow in memory, which can be exploited by a malicious guest to gain unauthorized access to protected information. This is achieved by abusing the disk driver, potentially leading to the disclosure of the host memory into the virtualized guest. **Recommendations** For HyperKit versions 0.20210107 and prior, update to a version that includes the fix committed in cf60095a4d8c3cb2e182a14415467afd356e982f to resolve the issue. As a temporary workaround, consider restricting access to the disk driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HyperKit versions 0.20210107 and prior **Description** HyperKit is a toolkit for embedding hypervisor capabilities in an application. The implementation of `qnotify` at `pci vtrnd notify` fails to check the return value of `vq getchain`, leading to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc fd, iov.iov base, iov.iov len);` when an attacker is able to make `vq getchain` fail. This issue may lead to a guest crashing the host, causing a denial of service, and under certain circumstances, memory corruption. **Recommendations** For HyperKit versions 0.20210107 and prior, update to a version that includes the fix from commit 41272a980197917df8e58ff90642d14dec8fe948 to resolve the issue. As a temporary workaround, consider restricting access to the `pci vtrnd notify` function to minimize the risk of exploitation. Additionally, avoid using the `vq getchain` function in a way that could cause it to fail, as this could lead to the uninitialized `struct iovec iov;` being used.

**Name of the Vulnerable Software and Affected Versions** HyperKit versions 0.20210107 and prior **Description** HyperKit is a toolkit for embedding hypervisor capabilities in an application. In the affected versions, `virtio.c` has a call to `vc cfgread` that does not check for null, which can cause the host to crash when called. This issue may lead to a guest crashing the host, resulting in a denial of service. **Recommendations** For HyperKit versions 0.20210107 and prior, update to a version that includes the fix committed in df0e46c7dbfd81a957d85e449ba41b52f6f7beb4 to resolve the issue. As a temporary workaround, consider restricting access to the `virtio.c` file or disabling the `vc cfgread` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HyperKit version 0.20210107 **Description** HyperKit is a toolkit for embedding hypervisor capabilities in an application. The function `pci vtsock proc tx` in `virtio-sock` can lead to uninitialized memory use due to an insufficient check for the return value. If the function returns `-1` upon encountering an unrecoverable error, the negative return value can be used by `iovec pull` in a while condition, potentially leading to further corruption because `iovec pull` is not designed to handle a negative `iov len`. This issue may cause a guest to crash the host, resulting in a denial of service, and under certain circumstances, memory corruption. **Recommendations** For HyperKit version 0.20210107, update to a version that includes the fix from commit af5eba2360a7351c08dfd9767d9be863a50ebaba to resolve the issue. As a temporary workaround, consider restricting the use of the `virtio-sock` module to minimize the risk of exploitation. Avoid using the `pci vtsock proc tx` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** HyperKit versions 0.20210107 and prior **Description** HyperKit is a toolkit for embedding hypervisor capabilities in an application. The issue arises from a call to `vc cfgwrite` in `vi pci write` that does not check for null, which can cause the host to crash when called. This may lead to a guest crashing the host, resulting in a denial of service. **Recommendations** For HyperKit versions 0.20210107 and prior, update to a version that includes the fix committed in 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13 to resolve the issue. As a temporary workaround, consider restricting access to the `vi pci write` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.13.6 **Description** The issue is related to the incorrect handling of unexpected data types in the Nokogiri library for Ruby. This can allow a remote attacker to disclose protected information or cause a denial of service. The library does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors or reads from unrelated memory. **Recommendations** For versions prior to 1.13.6, upgrade to Nokogiri version 1.13.6 or later. As a temporary workaround, ensure the untrusted input is a `String` by calling `#to s` or equivalent.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions 13.0-STABLE before n246941-20f96f215562 FreeBSD versions 12.2-STABLE before r370400 FreeBSD versions 11.4-STABLE before r370399 FreeBSD versions 13.0-RELEASE before p4 FreeBSD versions 12.2-RELEASE before p10 FreeBSD versions 11.4-RELEASE before p13 **Description** The issue arises from certain VirtIO-based device models in bhyve failing to handle errors when fetching I/O descriptors. A malicious guest may cause the device model to operate on uninitialized I/O vectors, leading to memory corruption, crashing of the bhyve process, and possibly arbitrary code execution in the bhyve process. **Recommendations** For FreeBSD versions 13.0-STABLE before n246941-20f96f215562, update to a version after n246941-20f96f215562. For FreeBSD versions 12.2-STABLE before r370400, update to a version after r370400. For FreeBSD versions 11.4-STABLE before r370399, update to a version after r370399. For FreeBSD versions 13.0-RELEASE before p4, update to a version after p4. For FreeBSD versions 12.2-RELEASE before p10, update to a version after p10. For FreeBSD versions 11.4-RELEASE before p13, update to a version after p13.

**Name of the Vulnerable Software and Affected Versions** hbs (affected versions not specified) **Description** The hbs package, an Express view engine wrapper for Handlebars, may be vulnerable to a file disclosure issue depending on its usage. This occurs because hbs combines pure template data with engine configuration options through the Express render API, allowing the overwrite of internal configuration options. This can trigger a file disclosure vulnerability in downstream applications. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** total.js versions prior to 3.4.9 **Description** The issue allows for Arbitrary Code Execution via the `U.set()` and `U.get()` functions. **Recommendations** For versions prior to 3.4.9, update to version 3.4.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Squirrelly versions prior to 9.0.0 **Description** Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. It mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options, remote code execution may be triggered in downstream applications. **Recommendations** For versions prior to 9.0.0, update to version 9.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the Express render API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** express-hbs (affected versions not specified) **Description** The issue arises from express-hbs mixing pure template data with engine configuration options through the Express render API, potentially leading to file disclosure vulnerabilities in downstream applications. This is somewhat restricted, as only files with existing extensions can be included. Files lacking an extension will have .hbs appended to them. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** haml-coffee versions prior to 1.14.1 **Description** haml-coffee is a JavaScript templating solution that mixes pure template data with engine configuration options through the Express render API. It supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user-controlled request objects to the haml-coffee template engine may introduce Remote Code Execution (RCE) vulnerabilities. Additionally, control over the `escapeHtml` parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs, which may result in reflected Cross Site Scripting attacks against downstream applications. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Express-handlebars (affected versions not specified) **Description** The layout parameter in Express-handlebars may trigger file disclosure vulnerabilities in downstream applications, allowing inclusion of files with existing extensions. Files without extensions will have .handlebars appended to them. This issue is related to the mixing of pure template data with engine configuration options through the Express render API. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TweetStream version 2.6.1 Description: The issue allows an attacker to perform a man-in-the-middle attack due to the insecure use of the eventmachine library, which lacks TLS hostname validation. Recommendations: For TweetStream version 2.6.1, consider disabling the use of the eventmachine library until a secure version is available, or apply a configuration change to enforce TLS hostname validation if possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: voloko twitter-stream version 0.1.10 voloko twitter-stream version 0.1.16 Description: The issue is related to missing TLS hostname validation, which allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the misuse of eventmachine. Recommendations: For voloko twitter-stream version 0.1.10, consider updating to a version where the TLS hostname validation issue is fixed. For voloko twitter-stream version 0.1.16, consider updating to a version where the TLS hostname validation issue is fixed. As a temporary workaround, consider restricting the use of the eventmachine until a patch is available.

**Name of the Vulnerable Software and Affected Versions** EM-HTTP-Request version 1.1.5 **Description** The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a TLS server certificate. **Recommendations** For EM-HTTP-Request version 1.1.5, consider updating to a newer version that properly verifies the hostname in TLS server certificates to prevent man-in-the-middle attacks. As a temporary workaround, restrict the use of the eventmachine library until a secure version is available.

**Name of the Vulnerable Software and Affected Versions** em-imap versions 0.5 and earlier **Description** The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a TLS server certificate. **Recommendations** For em-imap version 0.5 and earlier, consider updating to a version that securely uses the eventmachine library, ensuring the verification of the hostname in TLS server certificates. As a temporary workaround, restrict the use of the eventmachine library until a secure version is available.