Trung Nguyen

Malicious calendar invitations can utilize file URI attachments to execute local or network-hosted executables on Windows systems, bypassing standard executable attachment protections. When the new invitation display is enabled, these attachments may be presented with misleading filenames.

A heap-based buffer overflow occurs when a DNSCrypt query is received over TCP. The routine responsible for encrypting the reply in place does not bound the reply length against the destination buffer size, failing to apply the size clamp used in the UDP path. Consequently, a reply exceeding 65504 bytes is shifted forward by 48 bytes within a buffer of capacity `msg-buffer-size`, resulting in a write operation past the end of the heap allocation. This can be triggered by a single malicious encrypted query, causing the resolver to crash and leading to a denial of service. This issue requires the software to be compiled with DNSCrypt support via `--enable-dnscrypt` and the `dnscrypt:` clause to be configured and enabled for listening interfaces.

A missing authorization flaw exists in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying if the creator of the ClusterLogForwarder has the necessary permissions to use those credentials. This allows a delegated editor to exfiltrate ServiceAccount tokens and escalate privileges.

An issue exists allowing path traversal via the `keyhint` variable.

A zero-click remote code execution (RCE) issue exists due to path traversal. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Improper Isolation or Compartmentalization allows an administrator with sufficient entitlements for Implementations to create a malicious Groovy class. This class can contain untrusted code that reaches a non-sandboxed execution path through the class static initializer, potentially leading to remote code execution.

The issue in QEMU's softmmu/physmem.c file can lead to an uninitialized read on the translate fail path, resulting in an io readx or io writex crash. A third party notes that this might not be considered a security bug according to the Non-virtualization Use Case in the qemu.org reference. The vulnerability is related to the use of an uninitialized variable in the address space translate for iotlb() function, which could allow an attacker to cause a denial of service or execute arbitrary code.