Alchemist

A format string injection flaw exists in the uniprint device of Ghostscript, a PostScript and PDF interpreter. The issue occurs because the device allows users to pass string fragments as options—specifically `upWriteComponentCommands` and `upYMoveCommand`—which are then processed as format strings by the `gp fprintf()` and `gs snprintf()` functions without proper restriction. This can lead to memory corruption, data leakage from the stack, and a bypass of the SAFER sandbox, which is a security mode designed to prevent PostScript code from executing dangerous commands or accessing arbitrary files. Successful exploitation may allow an unauthenticated remote attacker to execute arbitrary code in the context of the Ghostscript process, potentially leading to full system compromise if the software is running with elevated privileges.

A security issue has been identified in the exception handling mechanism of mailcow, specifically when not operating in DEV MODE. The system saves exception details into a session array without proper sanitization or encoding, which are later rendered into HTML and executed in a JavaScript block within the user's browser without adequate escaping of HTML entities. This allows for Cross-Site Scripting (XSS) attacks, where attackers can inject malicious scripts into the admin panel by triggering exceptions with controlled input, potentially leading to session hijacking and unauthorized administrative actions.

Name of the Vulnerable Software and Affected Versions: mailcow:dockerized versions prior to 2024-04 Description: The issue is related to the `rspamd maps()` function and involves improper path validation, allowing for path traversal and arbitrary code execution. This can enable an authenticated admin user to overwrite any file writable by the www-data user, potentially leading to the execution of arbitrary commands on the server. Recommendations: For versions prior to 2024-04, update to version 2024-04 or later, which contains a patch for the issue. As a temporary workaround, consider restricting access to the `rspamd maps()` function to minimize the risk of exploitation. Additionally, ensure that proper access controls and permissions are in place for the www-data user to prevent unauthorized file overwrites.

Jenkins contains a flaw in its built-in Command Line Interface (CLI) due to the use of the `args4j` library for parsing command arguments. The parser includes a feature called `expandAtFiles` that is enabled by default, which replaces an `@` character followed by a file path in an argument with the actual contents of that file. This allows unauthenticated attackers to read arbitrary files from the Jenkins controller file system. Attackers with Overall/Read permissions can read entire files, while those without such permissions may still read the first few lines of certain files. This issue has been actively exploited by ransomware groups and other threat actors to steal cryptographic keys and sensitive data, and can be chained with other flaws to achieve remote code execution. Approximately 444,039 potentially affected instances have been identified globally.