Octavio Galland

Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently validate icon settings provided by users before they are rendered.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

A remote code execution issue exists within the Field UI module (`field ui`) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

The public API function BIO new NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO f asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64 write ASN1() which may cause BIO new NDEF() to be called and will subsequently call BIO pop() on the BIO. Other public API functions that may be impacted by this include i2d ASN1 bio stream, BIO new CMS, BIO new PKCS7, i2d CMS bio stream and i2d PKCS7 bio stream.

The SIP ALG function in Realtek eCos RSDK and MSDK has a stack-based buffer overflow that allows an attacker to remotely execute code without authentication via a crafted SIP packet containing malicious SDP data. This issue can be exploited by sending a specially crafted UDP packet, and it does not require user interaction or access to the admin interface. The vulnerability is notable for allowing attacks on devices with disabled web interface access from external networks. Potentially, millions of devices, from routers to signal amplifiers, are affected.

The issue is related to a heap-based out of bounds write in the `parse die()` function when reversing an AMD64 ELF binary with DWARF debug info. This can cause Rizin to crash or execute unintended actions when a malicious AMD64 ELF binary is opened.