Vulnerabilities

Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low)

Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)

<br /> An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.<br /> <br /> This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:<br /> <br /> <br /> <br /> * All versions prior to 21.4R3-S5-EVO;<br /> * 22.1 versions prior to 22.1R3-S4-EVO;<br /> * 22.2 versions 22.2R1-EVO and later;<br /> * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;<br /> * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;<br /> * 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.<br /> <br /> <br /> <br /> <br /> <br /> <br />

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

<br /> An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.<br /> <br /> This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:<br /> <br /> <br /> <br /> * All versions prior to 21.4R3-S4-EVO;<br /> * 22.1 versions prior to 22.1R3-S3-EVO;<br /> * 22.2 version 22.2R1-EVO and later versions;<br /> * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;<br /> * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;<br /> * 23.2 versions prior to 23.2R2-EVO.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in telemetry processing of Juniper Networks Junos OS allows a network-based authenticated attacker to flood the system with multiple telemetry requests, causing the Junos Kernel Debugging Streaming Daemon (jkdsd) process to crash, leading to a Denial of Service (DoS). Continued receipt and processing of telemetry requests will repeatedly crash the jkdsd process and sustain the Denial of Service (DoS) condition.<br /> <br /> This issue is seen on all Junos platforms. The crash is triggered when multiple telemetry requests come from different collectors. As the load increases, the Dynamic Rendering Daemon (drend) decides to defer processing and continue later, which results in a timing issue accessing stale memory, causing the jkdsd process to crash and restart.<br /> <br /> Note: jkdsd is not shipped with SRX Series devices and therefore are not affected by this vulnerability.<br /> This issue affects:<br /> <br /> Juniper Networks Junos OS:<br /> <br /> <br /> <br /> * 20.4 versions prior to 20.4R3-S9;<br /> * 21.1 versions 21.1R1 and later;<br /> * 21.2 versions prior to 21.2R3-S6;<br /> * 21.3 versions prior to 21.3R3-S5;<br /> * 21.4 versions prior to 21.4R3-S5;<br /> * 22.1 versions prior to 22.1R3-S4;<br /> * 22.2 versions prior to 22.2R3-S2;<br /> * 22.3 versions prior to 22.3R2-S1, 22.3R3-S1;<br /> * 22.4 versions prior to 22.4R2-S2, 22.4R3;<br /> * 23.1 versions prior to 23.1R2.<br /> <br /> <br /> <br /> <br /> This issue does not affect Juniper Networks Junos OS versions prior to 19.4R1.<br /> <br /> <br /> <br />

NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This old code was arranged to allow older NGINX versions to also support `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any `IgnoreIP` `IgnoreCIDR` for older versions.<br />