Sandbox escape in the Console component

Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

QUIC Uses Uninitialized Stack Bytes During Automated Peer Detection

Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets. Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic. CWE: CWE-457 (Use of Uninitialized Variable) Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake. This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module.

Windows iSCSI Information Disclosure Vulnerability

Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.

In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation.

In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.

In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Directory Traversal in Janus WebRTC Server Allows Unauthenticated File Read

Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio.

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

Spoofing issue in the Security component

Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Undefined behavior in the WebRTC: Networking component

Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Windows Kernel Transaction Manager Information Disclosure Vulnerability

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.