chromium-browser: Buffer overflow in Turbolev

Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing.

chromium-browser: chromium-browser: Arbitrary code execution in V8 via crafted HTML page

Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

X.Org Server EDID DS_RANGES Out-Of-Bounds Write

A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.

gittuf: Policy rules bypassed in the presence of global rules

In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not authorized by the policy rule, or fewer users than the rule's threshold, can make changes to the protected namespace that pass verification.

gittuf: Invalid intermediate policies trusted when the policy apply workflow is bypassed

In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being verified, verification checks only the root of trust signatures of the new policy and not the signatures of its other metadata (rule files). A user trusted to push to the repository who bypasses gittuf policy apply and writes the policy reference and reference state log directly can make an invalid policy apply during verification, weakening or strengthening the rules for later changes. The update is still recorded in the reference state log.

gittuf: Propagated controller policies not loaded during verification

In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification.

gittuf: File protection rules bypassed for filenames with special characters

In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.

RBH Integra32 5.1.11 .NET Remoting Deserialization RCE

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.

chromium-browser: chromium-browser: Out of bounds read in Media

Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

@utcp/http before 1.1.14 SSRF to Loopback via Host Placeholder in Call Templates

@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine.

webpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath

webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem.

Integer Overflow in Android Camera Driver Enables Local Information Disclosure

In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissions across configuration updates due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Secure World Register State Leak Leading to Local Information Disclosure in Android Trusty Context Switch

In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.

In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.