David Klein

The issue is related to a flaw in the CORS mechanism of Mozilla Firefox, Firefox ESR, and the Thunderbird email client, specifically an error in source data confirmation. This could allow a remote attacker to bypass security restrictions, potentially leading to the arbitrary loading of cross-origin pages.

The issue arises from an encoding problem in the serialization layer of TYPO3 HTML Sanitizer, allowing malicious markup nested in a `noscript` element to bypass the cross-site scripting mechanism. The `noscript` element is disabled by default but may be enabled in custom configurations. This enables the bypassing of the cross-site scripting protection provided by TYPO3 HTML Sanitizer.

Sanitize is an allowlist-based HTML and CSS sanitizer. When configured with a custom allowlist that allows `noscript` elements, attackers can include arbitrary HTML, resulting in cross-site scripting or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist.

The HTML sanitizer is written in PHP and aims to provide XSS-safe markup based on explicitly allowed tags, attributes, and values. However, due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed`, and `iframe`) as DOMText nodes, which were not processed and sanitized further. Only custom behaviors using one of those tag names were vulnerable to cross-site scripting.

The typo3/html-sanitizer package, an HTML sanitizer written in PHP, has a parsing issue due to the upstream package `masterminds/html5`. This issue allows malicious markup used in a sequence with special HTML comments to bypass the cross-site scripting mechanism.

The issue is related to a buffer overflow in the cuil component, allowing remote authenticated users to cause a denial of service, such as endpoint reboot or process crash, or possibly execute arbitrary code. This can be achieved by sending a long location parameter to the `getxml` program.

The issue allows remote attackers to cause a denial of service (crash) via a crafted SIP packet to port 5060 or 5061.