Vulnerabilidades

*** Pendiente de traducción *** Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

*** Pendiente de traducción *** Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV<br /> (RFC 8452) mishandle the authentication of AAD (Additional Authenticated<br /> Data) with an empty ciphertext allowing a forgery of such messages.<br /> <br /> Impact summary: An attacker can forge empty messages with arbitrary AAD<br /> to the victim&amp;#39;s application using these ciphers.<br /> <br /> AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD<br /> modes: they accept a key, nonce, optional AAD (bytes that are authenticated<br /> but not encrypted), and plaintext, and produces ciphertext plus a 16-byte<br /> tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only<br /> if the tag is verified succesfully.<br /> <br /> In OpenSSL&amp;#39;s provider implementation of these ciphers, the expected tag is<br /> computed only when decryption function is invoked with non-empty data.<br /> If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without<br /> invocation of the ciphertext update, which can happen when the received<br /> ciphertext length is zero, the tag is never recalculated and still holds its<br /> all-zeros value.<br /> <br /> When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty<br /> ciphertext, and all-zeros tag passes authentication under any key they do not<br /> know, single-shot. When AES-SIV is used, for mounting the attack it&amp;#39;s<br /> necessary for the application to reuse the decryption context without<br /> resetting the key.<br /> <br /> AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since<br /> OpenSSL 3.2.<br /> <br /> No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support<br /> either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must<br /> implement their own protocol and use the EVP interface. Also they must skip the<br /> ciphertext update when a message with an empty ciphertext arrives.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this<br /> issue, as these algorithms are not FIPS approved and the affected code is<br /> outside the OpenSSL FIPS module boundary.

*** Pendiente de traducción *** Access of resource using incompatible type (&amp;#39;type confusion&amp;#39;) in Microsoft Office allows an unauthorized attacker to execute code locally.

*** Pendiente de traducción *** Issue summary: A specially crafted PKCS#7 or S/MIME signed message could<br /> trigger a use-after-free during PKCS#7 signature verification.<br /> <br /> Impact summary: A use-after-free may result in process crashes, heap<br /> corruption, or potentially remote code execution.<br /> <br /> When processing a PKCS#7 or S/MIME signed message, if the SignedData<br /> digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may<br /> incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent<br /> use of the BIO by the calling application results in a use-after-free<br /> condition.<br /> <br /> In the common case this occurs when the application later calls<br /> BIO_free() on the BIO originally passed to PKCS7_verify(). Depending<br /> on allocator behavior and application-specific BIO usage patterns, this<br /> may result in a crash or other memory corruption. In some application<br /> contexts this may potentially be exploitable for remote code execution.<br /> <br /> Applications that process PKCS#7 or S/MIME signed messages using OpenSSL<br /> PKCS#7 APIs may be affected. Applications using the CMS APIs for this<br /> processing are not affected.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this<br /> issue, as the affected code is outside the OpenSSL FIPS module boundary.

*** Pendiente de traducción *** Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

*** Pendiente de traducción *** Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

*** Pendiente de traducción *** Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

*** Pendiente de traducción *** Issue summary: When an application drives an AES-OCB context through the<br /> public EVP_Cipher() one-shot interface, the application-supplied<br /> initialisation vector (IV) is silently discarded.<br /> <br /> Impact summary: Every message encrypted under the same key uses the<br /> same effective nonce regardless of the IV supplied by the caller,<br /> resulting in (key, nonce) reuse and loss of confidentiality. If the<br /> same code path is used to compute the authentication tag, the tag<br /> depends only on the (key, IV) pair and not on the plaintext or<br /> ciphertext, allowing universal forgery of arbitrary ciphertext from a<br /> single captured message.<br /> <br /> OpenSSL provides two ways to drive a cipher: the documented streaming<br /> interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level<br /> one-shot, EVP_Cipher(), whose documentation explicitly recommends<br /> against use by applications in favour of EVP_CipherUpdate() and<br /> EVP_CipherFinal_ex(). The OCB provider&amp;#39;s streaming handler flushes<br /> the application-supplied IV into the OCB context before processing<br /> data; the one-shot handler did not. Every call to EVP_Cipher() on an<br /> AES-OCB context therefore ran with the all-zero key-derived offset<br /> state left by cipher initialisation, regardless of the caller&amp;#39;s IV.<br /> <br /> If EVP_EncryptFinal_ex() is subsequently used to obtain the<br /> authentication tag, the deferred IV setup runs at that point and<br /> clears the running checksum that should have been accumulated over the<br /> plaintext. The resulting tag is a function of (key, IV) only and<br /> verifies against any ciphertext produced under the same (key, IV)<br /> pair.<br /> <br /> The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a<br /> TLS cipher suite, and libssl does not call EVP_Cipher() in any case.<br /> Applications that drive AES-OCB through the documented streaming AEAD<br /> API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only<br /> applications that combine the AES-OCB cipher with the EVP_Cipher()<br /> one-shot API are vulnerable.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by<br /> this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

*** Pendiente de traducción *** Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

*** Pendiente de traducción *** Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

*** Pendiente de traducción *** Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

*** Pendiente de traducción *** Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.