Vulnerabilidades

*** Pendiente de traducción *** bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier's choosing. Versions 2.2.6 and 3.0.2 add the delimiter.

*** Pendiente de traducción *** FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the neighbouring info values in the same component are rendered as React children and are escaped, so the description is the only raw path. A description is free-form text held in the dataset schema, so it persists in the database and travels with an exported or published dataset. Opening a dataset obtained from another party and hovering the field runs the stored markup in the application's origin. That origin is shared with the FiftyOne server, whose media route returns the contents of a caller-named absolute path and which is unauthenticated in the open-source server, so the injected script can read local files and reach the dataset and operator endpoints as the viewing user.

*** Pendiente de traducción *** DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.

*** Pendiente de traducción *** SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many, and getusers, do not enforce the senaite.core: Access JSON API permission before resolving attacker-selected objects. In src/bika/lims/jsonapi/init.py, set_fields_from_request passes raw request values for RecordsField and RecordField instances to eval() before field mutator write-permission checks execute. An anonymous attacker can discover the bika_setup object identifier through @@uuid, send a value such as RejectionReasons to /@@API/update, and execute arbitrary Python in the Zope worker before a later mutation failure rolls back ZODB changes. The same unsafe evaluation pattern is present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can expose or modify laboratory data, files, and accounts and can disrupt the service.

*** Pendiente de traducción *** SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

*** Pendiente de traducción *** Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.

*** Pendiente de traducción *** Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: avoid combining some incoming suboptions<br /> <br /> Some MPTCP suboptions are mutually exclusive according to the RFC8684,<br /> but also because in different places, the code doesn&amp;#39;t expect some<br /> combinations to be present. That&amp;#39;s specially true for suboptions that<br /> would be present twice, but with different attributes.<br /> <br /> The new restrictions are the same as the ones applied on the output<br /> side, with mptcp_write_options. The same rules can be reused with a<br /> small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks<br /> this option [1], which is not the case on Linux. Here are the rules:<br /> <br /> Which options can be used together?<br /> <br /> X: mutually exclusive<br /> O: often used together<br /> C: can be used together in some cases<br /> P: could be used together but we prefer not to (optimisations)<br /> <br /> | Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC |<br /> |------|------|------|------|------|------|------|------|------|<br /> | MPC |------|------|------|------|------|------|------|------|<br /> | MPJ | X |------|------|------|------|------|------|------|<br /> | DSS | X | X |------|------|------|------|------|------|<br /> | ADD | X | X | P |------|------|------|------|------|<br /> | RM | C | C | C | P |------|------|------|------|<br /> | PRIO | X | C | C | C | C |------|------|------|<br /> | FAIL | X | X | C | X | X | X |------|------|<br /> | FC | X | X | P | X | X | X | X |------|<br /> | RST | X | X | X | X | X | X | O | O |<br /> |------|------|------|------|------|------|------|------|------|<br /> <br /> The only difference is with the &amp;#39;P&amp;#39;: another stack could send and<br /> ADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be<br /> allowed.<br /> <br /> A few points of attention:<br /> <br /> - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is<br /> no reason to add it with a SYN. Note that even with a 4th ACK, it<br /> doesn&amp;#39;t seem to be useful, except when IDs are known in advance via<br /> another channel. Better not to break that.<br /> <br /> - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer<br /> result to a reject of the two options, but only the second suboption<br /> is ignored. That seems OK to do that for this unexpected error. At<br /> least now all inconsistent combinations are handled the same way.<br /> This could change later in next. This also means the explicit checks<br /> for having both MPC + MPJ in subflow.c will now be unreachable.<br /> That&amp;#39;s fine, they will be removed in a follow-up patch.<br /> <br /> - In case of conflicting combinations, the extra suboption(s) is/are<br /> ignored: having such combinations either means the remote peer is<br /> buggy, or is evil. The simplest action is then taken in this case:<br /> stop processing the current suboption.<br /> <br /> - In mp_opt-&gt;suboptions, there is also a bit reserved to the checksum,<br /> which can be used in an MP_CAPABLE and a DSS. Each time a DSS option<br /> can be used in parallel with another option, the checksum can be set,<br /> so the verification is combined into a new OPTIONS_MPTCP_DSS macro.<br /> <br /> - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional<br /> Checksum: they are the same as the ones found in a DSS, because a DSS<br /> cannot be used in parallel to an MP_CAPABLE. Similarly, even if there<br /> is room, a DSS cannot be used with an MP_JOIN.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: reclaim forward-allocated memory on RX path errors<br /> <br /> After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"),<br /> errors in the receive path prior to queueing skbs into the receive<br /> queue do not trigger forward-allocated memory reclaiming.<br /> <br /> Prevent forward memory from growing unboundedly in pathological drop<br /> scenarios by explicitly reclaiming memory when skbs are dropped.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> block: stop the timeout timer when releasing a never added disk<br /> <br /> disk_release() undoes blk_mq_init_allocated_queue() for a disk whose<br /> probe failed before add_disk(), but it only calls blk_mq_exit_queue().<br /> Nothing there stops q-&gt;timeout, and that timer rolls forward: it stays<br /> pending until it next expires, not until the last request completes.<br /> So if the driver issued any I/O before adding the disk, the<br /> request_queue is freed while still linked into a timer wheel bucket.<br /> <br /> Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the<br /> blk_cleanup_queue() call that used to stop it. __del_gendisk() and<br /> blk_mq_destroy_queue() still do; only the probe failure path lost it.<br /> <br /> nvme gets there because nvme_update_ns_info() submits Report Zones or<br /> FDP io-mgmt-recv on ns-&gt;queue before the disk is added, so a later<br /> failure - a concurrent reset setting NVME_CTRL_FROZEN, or<br /> device_add_disk() failing - lands in put_disk() with the timer armed:<br /> <br /> BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340<br /> Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37<br /> __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621<br /> blk_sync_queue+0x22/0x40 block/blk-core.c:222<br /> nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362<br /> nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264<br /> <br /> Allocated by task 34:<br /> __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462<br /> nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146<br /> <br /> Freed by task 0:<br /> blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254<br /> rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857<br /> <br /> The queue being synced there is ctrl-&gt;admin_q, only a victim sharing a<br /> timer wheel bucket with the freed queue&amp;#39;s dangling entry; other runs<br /> tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().<br /> Failing nvme_alloc_ns() with a debug patch makes it deterministic: one<br /> leaked timer trips KASAN within seconds, while 1987 patched releases<br /> produced no splat.<br /> <br /> Stop the timer and the queue work items before blk_mq_exit_queue(), like<br /> blk_mq_destroy_queue() does.<br /> <br /> Found by FuzzNvme.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: clear fb_info-&gt;mode before deleting a videomode<br /> <br /> fb_set_var() can delete a mode from info-&gt;modelist when userspace<br /> passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code<br /> checks that the mode being deleted is not the current info-&gt;var and<br /> that fbcon is not using it, but it does not check fb_info-&gt;mode.<br /> <br /> fb_info-&gt;mode may still point into the modelist entry being deleted.<br /> If the entry is freed, later mode sysfs reads through show_mode() can<br /> dereference a stale pointer.<br /> <br /> Clear fb_info-&gt;mode before calling fb_delete_videomode() when it<br /> matches the mode being removed.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: bound mode sysfs output to the sysfs buffer<br /> <br /> mode_string() uses snprintf() which can return a value larger than the<br /> remaining buffer space. show_modes() accumulates the return value into i<br /> without checking whether i has reached PAGE_SIZE, causing the offset to<br /> advance past the sysfs buffer if the modelist is long enough.<br /> <br /> Add a size parameter to mode_string() and use scnprintf() to return<br /> only the bytes actually written. Add an early return when offset<br /> already exceeds the buffer. In show_modes(), stop accumulating once<br /> the buffer is full.