Vulnerabilidades

*** Pendiente de traducción *** A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8ffa800e68. It is advisable to implement a patch to correct this issue.

*** Pendiente de traducción *** A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.

*** Pendiente de traducción *** A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

*** Pendiente de traducción *** A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performing a manipulation of the argument port results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

*** Pendiente de traducción *** A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such manipulation of the argument frame/dirno leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

*** Pendiente de traducción *** A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation results in missing authentication. An attack on the physical device is feasible. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack on the physical device. The attack's complexity is rated as high. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing a manipulation can lead to weak password requirements. The physical device can be targeted for the attack. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a manipulation results in information disclosure. The attack may be carried out on the physical device. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/damon/core: remove call_control in inactive contexts<br /> <br /> If damon_call() is executed against a DAMON context that is not running,<br /> the function returns error while keeping the damon_call_control object<br /> linked to the context&amp;#39;s call_controls list. Let&amp;#39;s suppose the object is<br /> deallocated after the damon_call(), and yet another damon_call() is<br /> executed against the same context. The function tries to add the new<br /> damon_call_control object to the call_controls list, which still has the<br /> pointer to the previous damon_call_control object, which is deallocated. <br /> As a result, use-after-free happens.<br /> <br /> This can actually be triggered using the DAMON sysfs interface. It is not<br /> easily exploitable since it requires the sysfs write permission and making<br /> a definitely weird file writes, though. Please refer to the report for<br /> more details about the issue reproduction steps.<br /> <br /> Fix the issue by making two changes. Firstly, move the final<br /> kdamond_call() for cancelling all existing damon_call() requests from<br /> terminating DAMON context to be done before the ctx-&gt;kdamond reset. This<br /> makes any code that sees NULL ctx-&gt;kdamond can safely assume the context<br /> may not access damon_call() requests anymore. Secondly, let damon_call()<br /> to cleanup the damon_call_control objects that were added to the<br /> already-terminated DAMON context, before returning the error.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback<br /> <br /> octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to<br /> ioq_vector. If request_irq() fails part-way, the rollback loop calls<br /> free_irq() with dev_id set to &amp;#39;oct&amp;#39;, which does not match the original<br /> dev_id and may leave the irqaction registered.<br /> <br /> This can keep IRQ handlers alive while ioq_vector is later freed during<br /> unwind/teardown, leading to a use-after-free or crash when an interrupt<br /> fires.<br /> <br /> Fix the error path to free IRQs with the same ioq_vector dev_id used<br /> during request_irq().