Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO<br /> <br /> nf_osf_match_one() computes ctx-&gt;window % f-&gt;wss.val in the<br /> OSF_WSS_MODULO branch with no guard for f-&gt;wss.val == 0. A<br /> CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a<br /> subsequent matching TCP SYN divides by zero and panics the kernel.<br /> <br /> Reject the bogus fingerprint in nfnl_osf_add_callback() above the<br /> per-option for-loop. f-&gt;wss is per-fingerprint, not per-option, so<br /> the check must run regardless of f-&gt;opt_num (including 0). Also<br /> reject wss.wc &gt;= OSF_WSS_MAX; nf_osf_match_one() already treats that<br /> as "should not happen".<br /> <br /> Crash:<br /> Oops: divide error: 0000 [#1] SMP KASAN NOPTI<br /> RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)<br /> Call Trace:<br /> <br /> nf_osf_match (net/netfilter/nfnetlink_osf.c:220)<br /> xt_osf_match_packet (net/netfilter/xt_osf.c:32)<br /> ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)<br /> nf_hook_slow (net/netfilter/core.c:622)<br /> ip_local_deliver (net/ipv4/ip_input.c:265)<br /> ip_rcv (include/linux/skbuff.h:1162)<br /> __netif_receive_skb_one_core (net/core/dev.c:6181)<br /> process_backlog (net/core/dev.c:6642)<br /> __napi_poll (net/core/dev.c:7710)<br /> net_rx_action (net/core/dev.c:7945)<br /> handle_softirqs (kernel/softirq.c:622)

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> openvswitch: cap upcall PID array size and pre-size vport replies<br /> <br /> The vport netlink reply helpers allocate a fixed-size skb with<br /> nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID<br /> array via ovs_vport_get_upcall_portids(). Since<br /> ovs_vport_set_upcall_portids() accepts any non-zero multiple of<br /> sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID<br /> array large enough to overflow the reply buffer, causing nla_put() to<br /> fail with -EMSGSIZE and hitting BUG_ON(err

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()<br /> <br /> CO-RE accessor strings are colon-separated indices that describe a path<br /> from a root BTF type to a target field, e.g. "0:1:2" walks through<br /> nested struct members. bpf_core_parse_spec() parses each component with<br /> sscanf("%d"), so negative values like -1 are silently accepted. The<br /> subsequent bounds checks (access_idx &gt;= btf_vlen(t)) only guard the<br /> upper bound and always pass for negative values because C integer<br /> promotion converts the __u16 btf_vlen result to int, making the<br /> comparison (int)(-1) &gt;= (int)(N) false for any positive N.<br /> <br /> When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,<br /> producing an out-of-bounds read far past the members array. A crafted<br /> BPF program with a negative CO-RE accessor on any struct that exists in<br /> vmlinux BTF (e.g. task_struct) crashes the kernel deterministically<br /> during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y<br /> (default on major distributions). The bug is reachable with CAP_BPF:<br /> <br /> BUG: unable to handle page fault for address: ffffed11818b6626<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> Oops: Oops: 0000 [#1] SMP KASAN NOPTI<br /> CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)<br /> RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)<br /> RAX: 00000000ffffffff<br /> Call Trace:<br /> <br /> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)<br /> bpf_core_apply (kernel/bpf/btf.c:9507)<br /> check_core_relo (kernel/bpf/verifier.c:19475)<br /> bpf_check (kernel/bpf/verifier.c:26031)<br /> bpf_prog_load (kernel/bpf/syscall.c:3089)<br /> __sys_bpf (kernel/bpf/syscall.c:6228)<br /> <br /> <br /> CO-RE accessor indices are inherently non-negative (struct member index,<br /> array element index, or enumerator index), so reject them immediately<br /> after parsing.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: fix end-of-list detection in cgroup_storage_get_next_key()<br /> <br /> list_next_entry() never returns NULL -- when the current element is the<br /> last entry it wraps to the list head via container_of(). The subsequent<br /> NULL check is therefore dead code and get_next_key() never returns<br /> -ENOENT for the last element, instead reading storage-&gt;key from a bogus<br /> pointer that aliases internal map fields and copying the result to<br /> userspace.<br /> <br /> Replace it with list_entry_is_head() so the function correctly returns<br /> -ENOENT when there are no more entries.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Fix use-after-free in arena_vm_close on fork<br /> <br /> arena_vm_open() only bumps vml-&gt;mmap_count but never registers the<br /> child VMA in arena-&gt;vma_list. The vml-&gt;vma always points at the<br /> parent VMA, so after parent munmap the pointer dangles. If the child<br /> then calls bpf_arena_free_pages(), zap_pages() reads the stale<br /> vml-&gt;vma triggering use-after-free.<br /> <br /> Fix this by preventing the arena VMA from being inherited across<br /> fork with VM_DONTCOPY, and preventing VMA splits via the may_split<br /> callback.<br /> <br /> Also reject mremap with a .mremap callback returning -EINVAL. A<br /> same-size mremap(MREMAP_FIXED) on the full arena VMA reaches<br /> copy_vma() through the following path:<br /> <br /> check_prep_vma() - returns 0 early: new_len == old_len<br /> skips VM_DONTEXPAND check<br /> prep_move_vma() - vm_start == old_addr and<br /> vm_end == old_addr + old_len<br /> so may_split is never called<br /> move_vma()<br /> copy_vma_and_data()<br /> copy_vma()<br /> vm_area_dup() - copies vm_private_data (vml pointer)<br /> vm_ops-&gt;open() - bumps vml-&gt;mmap_count<br /> vm_ops-&gt;mremap() - returns -EINVAL, rollback unmaps new VMA<br /> <br /> The refcount ensures the rollback&amp;#39;s arena_vm_close does not free<br /> the vml shared with the original VMA.

*** Pendiente de traducción *** Improper Limitation of a Pathname to a Restricted Directory (&amp;#39;Path Traversal&amp;#39;) vulnerability in Ludwig You QuickWebP &amp;#8211; Compress / Optimize Images &amp;amp; Convert WebP | SEO Friendly quickwebp allows Path Traversal.This issue affects QuickWebP &amp;#8211; Compress / Optimize Images &amp;amp; Convert WebP | SEO Friendly: from n/a through

*** Pendiente de traducción *** Improper Limitation of a Pathname to a Restricted Directory (&amp;#39;Path Traversal&amp;#39;) vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Path Traversal.This issue affects WebinarIgnition: from n/a through

*** Pendiente de traducción *** Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through

*** Pendiente de traducción *** Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in Timo Affiliate Super Assistent amazonsimpleadmin allows Stored XSS.This issue affects Affiliate Super Assistent: from n/a through

*** Pendiente de traducción *** Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through

*** Pendiente de traducción *** Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through

*** Pendiente de traducción *** Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in e4jvikwp VikBooking Hotel Booking Engine &amp; PMS vikbooking allows DOM-Based XSS.This issue affects VikBooking Hotel Booking Engine &amp; PMS: from n/a through