Nicholas Carlini

App passwords were allowed to bypass password confirmation on sensitive endpoints.

A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, can lead to memory corruption. This can be triggered when the system processes maliciously crafted web content.

An issue exists in the ARM64 NEON ciphertext comparison where only half of the input is compared. This failure breaks the implicit rejection of the Fujisaki-Okamoto transform—a method used to ensure that a ciphertext has not been tampered with—and weakens IND-CCA2 security, which refers to the security of a system against chosen-ciphertext attacks. Consequently, a decapsulating party may fail to detect a manipulated ciphertext and proceed without the required implicit rejection.

A signer confusion issue in PKCS7 verify allows for forged signatures. This occurs because the signer associated with a signature is not correctly bound, which permits a forged signature to be accepted.

An issue exists in the `EVP DigestVerifyFinal()` function where a zero-length tag could be accepted as valid during HMAC (Hash-based Message Authentication Code) verification. In the OpenSSL-compatibility HMAC verify path, the supplied signature length was only checked to ensure it did not exceed the MAC length, allowing a zero-length or truncated tag to pass verification.

A heap buffer overflow occurs in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The issue stems from an integer truncation when calculating the length of the ACK record-number list, which leads to the allocation of an undersized buffer that is subsequently overrun.

The PKCS#7 decode path fails to respect the caller-supplied output buffer size `outputSz`. This allows decoded content to be written beyond the boundaries of the provided buffer, leading to a buffer overflow. A buffer overflow occurs when a program writes more data to a block of memory than it is allocated to hold.

PKCS#12 MAC verification uses a comparison length controlled by an attacker, which weakens the integrity check on the Message Authentication Code (MAC) and allows a mismatched MAC to be accepted. The verification path compares the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest produced by the configured algorithm. Consequently, a zero-length or truncated stored MAC could be accepted, defeating the integrity protection.

A stack buffer overflow exists in the `piv process history()` function within `src/libopensc/card-piv.c`. This issue allows a physically present attacker to cause memory corruption by using a specially crafted PIV smart card or USB device. The trigger occurs when the device returns a URL field exceeding 118 bytes in the Key History Object ASN.1 response.

A stack and heap buffer overrun occurs in the `do key value()` function within src/pkcs15init/profile.c. This issue allows memory corruption when a crafted profile configuration file is supplied. During the invocation of pkcs15-init, a key value entry starting with '=' followed by more than the size of `keybuf` is copied into `keybuf` using memcpy without a length check.

A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, can lead to an unexpected Safari crash when processing maliciously crafted web content.

The implementation of TIOCNOTTY fails to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process exits, the terminal structure may retain a pointer to freed memory, creating a dangling pointer. A malicious process can exploit this condition to obtain root privileges.

A flaw exists in the kernel's handling of protection keys for address ranges. The subroutine responsible for updating page table entries fails to account for 1GB largepage mappings created via the `shm create largepage(3)` interface, incorrectly treating page directory page entries as pointers to other page table pages. An unprivileged user can exploit this by causing the `pmap pkru update range()` function to treat userspace memory as a page table page, allowing the overwrite of memory that should otherwise be inaccessible. This issue is under active exploitation and can lead to unauthorized access and data breaches.

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.11.1 Description The Botan cryptography library contains a flaw in the `Certificate Store::certificate known` function. This function incorrectly identifies certificates, returning true if any certificate in the store has a matching Distinguished Name (DN) and Subject Key Identifier (SKI) with the provided certificate, without verifying if the certificates are identical. A subsequent extension of path validation logic incorrectly assumed that `certificate known` only returned true for identical certificates. This allows an end entity certificate to be accepted as a trusted root if its DN and SKI match those of a trusted root certificate. Recommendations Update to version 3.11.1 or later.

Missing hash/digest size and Object Identifier (OID) checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than appropriate for the relevant key type, to be accepted by signature verification functions. This flaw enables the acceptance of forged digital identities, potentially allowing a malicious server, file, or connection to be trusted. The issue affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled, specifically impacting the library's handling of signatures in ECDSA, DSA, ML-DSA, Ed25519, and Ed448. It is estimated that over 5 billion devices worldwide are potentially affected, including embedded systems, IoT devices, routers, automotive systems, power grid infrastructure, and military systems.

A stack-based buffer overflow exists in the `kgssapi.ko` kernel module and the `librpcgss sec` library. The issue occurs during the validation of RPCSEC GSS data packets, where a routine responsible for checking the packet signature copies data into a stack buffer without verifying if the buffer is sufficiently large. This flaw can be triggered by a malicious client and does not require prior authentication. In the kernel, this allows an authenticated user to achieve remote code execution (RCE) if they can send packets to the kernel's NFS server while `kgssapi.ko` is loaded. In userspace, any application that loads `librpcgss sec` and operates an RPC server is vulnerable to RCE from any client capable of sending packets to it.

A use-after-free issue exists in the JavaScript Engine component. This condition may allow for unexpected behavior.

An undefined behavior issue exists in the Audio/Video component. This can lead to unexpected program behavior.

A blind SQL injection exists in the Content API of Ghost, a Node.js content management system. The issue stems from the use of string concatenation instead of parameterized queries when processing user input in the `slug` filter, allowing unauthenticated attackers to perform arbitrary reads from the database. This flaw was exploited in a large-scale campaign affecting over 700 domains, including high-profile institutions like Harvard and Oxford Universities. Attackers used the `/ghost/api/content/tags/` endpoint to steal Admin API keys, which granted them the ability to modify site content. This was used to inject malicious JavaScript loaders that executed "ClickFix" social engineering attacks, deceiving visitors into running harmful commands on their local machines to install infostealers and Remote Access Trojans (RATs).

An undefined behavior exists within the WebRTC: Signaling component. This issue impacts the listed versions of Firefox and Thunderbird.