The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually. This is the cross platform package.

Zed Attack Proxy 2.14.0 Cross Platform Package

WordPress Core versions prior to 6.3.2 suffer from arbitrary shortcode execution, cross site scripting, denial of service, and information leakage vulnerabilities. Versions prior to 6.3.2 are vulnerable.

The newest WordPress patch includes fixes for 8 Medium-Severity security issues, several of which are trivial to exploit.

WordPress Core 6.3.2 was released today, on October 12, 2023. It includes a number of security fixes and additional hardening against commonly exploited vulnerabilities. While all of the vulnerabilities are of Medium severity, several of them are impactful enough to potentially allow site takeover, and thus the 6.3.2 update has the most significant security fixes we’ve seen in a while.

Many of these patches have been backported to every version of WordPress since 4.1, with just a few being backported to the major version in which the functionality was released. WordPress has supported automatic core updates for security releases since WordPress 3.7, and the vast majority of WordPress sites should receive a patch for their major version of WordPress automatically over the next 24 hours. We recommend verifying that your site has been automatically updated to one of the patched versions. Patched versions are available for every major version of WordPress since 4.1, so you can update without risking compatibility issues.

The Wordfence Threat Intelligence Team released two new firewall rules today to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers against the most impactful vulnerabilities patched, and these rules will be available to free Wordfence users in 30 days, on November 11th, 2023.

If your site has not been updated automatically we strongly recommend updating manually as soon as possible, as one of the vulnerabilities patched in this release can be used by an attacker with a low-privileged contributor-level account to take over a site.

Technical Analysis and Overview

As with every WordPress core release containing security fixes, the Wordfence Threat Intelligence team analyzed the code changes in detail to evaluate the impact of these vulnerabilities on our customers, and to ensure our customers remain protected.

No More ShortCode Abuse

Description: WordPress Core <= 6.3.1 – Authenticated (Subscriber+) Arbitrary Shortcode Execution

Affected Versions: WordPress Core < 6.3.2

Researcher: James Golovich & WhiteCyberSec 

CVE ID: Pending

CVSS Score: 5.4(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to arbitrary shortcode execution in versions up to, and including, 6.3.1 due to a lack of input validation on the ‘shortcode’ parameter in the parse_media_shortcode AJAX function. This allows authenticated attackers, with subscriber-level privileges and above, to execute arbitrary shortcodes.

While this patch does not address a specific vulnerability, it blocks a common vector that enables attackers to exploit vulnerabilities that use shortcodes. Before WordPress 6.3.2, any authenticated user, including subscribers could execute any shortcode by calling the built-in ‘parse-media-shortcode’ AJAX handler.

The changeset in WordPress 6.3.2 restricts this AJAX handler to media shortcodes, and requires the ’embed’ shortcode to be associated with an active post ID that the user can access.

This means that a large range of SQL Injection, Sensitive Information Disclosure, and Remote Code Execution vulnerabilities that required only an active user login can now only be exploited by Contributor-level users or above.

You can find several of the shortcode-based vulnerabilities we reference by searching the Wordfence Intelligence vulnerability database.

Previously our team could not add a firewall rule to prevent the execution of arbitrary shortcodes due to the varying use cases. Fortunately, with this patch and change, the expected behavior of the parse-media-shortcode action has been restricted by WordPress Core, so we were able to create a generic firewall rule that will prevent arbitrary execution of shortcodes that are not in the allowlist from the function. Wordfence Premium, Care, and Response customers received this rule today, while those still on the free version of Wordfence will receive this rule after a 30 day delay on November 11th, 2023.

Reflected Cross-Site Scripting via Application Passwords

Description: WordPress Core 5.6-6.3.1 – Reflected Cross-Site Scripting via Application Password Requests

Affected Versions: WordPress Core < 6.3.2

Researcher: mascara7784 

CVE ID: Pending

CVSS Score: 6.1(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to Reflected Cross-Site Scripting via the ‘success_url’ and ‘reject_url’ parameters when requesting application passwords in versions between 5.6 and 6.3.1 due to insufficient input sanitization and output escaping of pseudo protocol URIs. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link and accepting or rejecting the application password.

WordPress allows applications to request application passwords to be generated for them. WordPress before 6.3.2 fails to validate the redirect URIs used when a password is authorized or rejected, which means that an attacker could generate a URL for an application password request containing data: and javascript: pseduo protocol redirects. If the victim visits this URL on their site and approves or rejects the application password request, they could be redirected to a URI that executes JavaScript on their browser. WordPress 6.3.2 contains a patch for this issue.

As with all Cross-Site Scripting vulnerabilities, this can be used to take over a site by creating malicious administrators and backdoors.

All Wordfence users, including Wordfence free, Wordfence Premium, Wordfence Care, and Wordfence Response users are protected against this vulnerability by the Wordfence Firewall’s Built-in Cross-Site Scripting protection. Additionally, Wordfence disables application passwords by default.

Comment Visibility

Description: WordPress Core <= 6.3.1 – Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts

Affected Versions: WordPress Core < 6.3.2

Researcher: JB Audras(WordPress Security Team) & Rafie Muhammad(Patchstack) 

CVE ID: Pending

CVSS Score: 4.3(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.3.1 via the comments listing. This allows authenticated users, with contributor-level privileges or above, to view comments on protected posts.

Prior to WordPress 6.3.2, it was possible for users to view comments on posts even when they did not have access to those posts. While this is in most cases a relatively low-impact issue, WordPress 6.3.2 contains a patch protecting the privacy of comments on private or protected posts.

Removing POP Chains

While WordPress Core has not had a known Object Injection vulnerability for some time, Object Injection vulnerabilities in various plugins and themes are regularly discovered by researchers, including Wordfence’s own in-house Threat Intelligence team.

All Object Injection vulnerabilities require POP chains in order to be successful. Prior to WordPress 6.3.2, potential POP chains were present in the WP_Theme, WP_Block_Type_Registry, WP_Block_Patterns_Registry, Requests/Session, Request/Iri, and Requests/Hooks classes. While we were unable to develop a functioning exploit for these in the time available, the patches involved indicate that they are designed to prevent unexpected Object Unserialization that could lead to Remote Code Execution. Credit to Marc Montpas of Automattic for discovering the vulnerable POP chains.

The Wordfence Threat Intelligence Team will continue reverse engineering this patch to determine if a firewall rule will be necessary, but at this time it has not received an official vulnerability entry because it is not technically a vulnerability on its own.

No More Searching By Email

Description: WordPress Core 4.7.0-6.3.1 – Sensitive Information Exposure via User Search REST Endpoint

Affected Versions: WordPress Core < 6.3.2

Researcher: Marc Montpas(Automattic) 

CVE ID: Pending

CVSS Score: 5.3(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the ‘list_users’ capability, the search is applied to the user_email column. This can allow unauthenticated attackers to brute force or verify the email addresses of users with published posts or pages on the site.

While WordPress prior to 6.3.2 did not directly display user email addresses to users without the “list_users” capability, it still searched the user email column in wp_users. This meant that it was possible to brute-force search or verify the email address of any user with a published post or page by including the partial email address in the search parameter, potentially impacting user privacy. The patch for this limits the search columns for users without the “list_users” capability to only the columns displayed.

Cache Poisoning Denial of Service

Description: WordPress Core 4.7.0-6.3.1 – Denial of Service via Cache Poisoning

Affected Versions: WordPress Core < 6.3.2

Researcher: s5s & raouf_maklouf 

CVE ID: Pending

CVSS Score: 5.3(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to Denial of Service via Cache Poisoning in versions between 4.7.0 and 6.3.1. In cases where the X-HTTP-Method-Override header was sent in a request to a REST endpoint and the endpoint returned a 4xx error, the error could be cached, resulting in denial of service.

Responses to REST API requests are not cached for logged-in users, but WordPress Core before 6.3.2 had an edge case where, in heavily cached configurations, an unauthenticated attacker could send a request to the REST API using the X-HTTP-Method-Override header to a public endpoint and receive a 4xx error, either because the endpoint restricts access to those methods or does not support them at all. In cases where the error is cached, any other unauthenticated visitors attempting to retrieve data from that endpoint would see the cached 4xx error.

Contributor+ Stored Cross-Site Scripting in Footnotes

Description: WordPress Core 6.3-6.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Footnotes Block

Affected Versions: WordPress Core < 6.3.2

Researcher: Jorge Costa(WordPress Core Team) 

CVE ID: Pending

CVSS Score: 6.4(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to Stored Cross-Site Scripting via the footnotes block in versions between 6.3 and 6.3.1 due to insufficient input sanitization and output escaping on the footnotes block. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

WordPress prior to 6.3.2 did not adequately sanitize the content of footnote blocks, allowing authenticated users, with Contributor-level privileges or above, to insert JavaScript that would execute when a page containing the footnotes was visited. While input is partially escaped on the client-side, it is possible to intercept a request and add unescaped script tags to the footnote metadata. WordPress has released a patch for this vulnerability in 6.3.2.

As with all Cross-Site Scripting vulnerabilities, this can be used to take over a site by creating malicious administrators and backdoors.

We have released a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response users against this vulnerability, and free Wordfence users will receive the same protection in 30 days, on November 11th, 2023.

Contributor+ Stored Cross-Site Scripting in Navigation Links

Description: WordPress Core 5.9-6.3.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via navigation attributes

Affected Versions: WordPress Core 5.9-6.3.1

Researcher: Rafie Muhammad & Edouard L of Patchstack 

CVE ID: Pending

CVSS Score: 6.4(Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Fully Patched Version: 6.3.2

Wordfence Intelligence Reference 

WordPress Core is vulnerable to Stored Cross-Site Scripting via the arrow navigation block attributes in versions between 5.9 and 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level privileges and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

WordPress Core’s Block Editor includes a navigation block that includes arrows or chevrons to display previous and next posts. WordPress before 6.3.2 failed to adequately check or sanitize the attribute defining whether to use an arrow or a chevron. As a result, any user with access to the post editor could insert malicious JavaScript into the arrow navigation element, which would be executed whenever a visitor accessed that page.

As with all Cross-Site Scripting vulnerabilities, this can be used to take over a site by creating malicious administrators and backdoors. We were unable to successfully exploit this vulnerability at the time of publication, but will update this post if we are able to achieve a proof of concept, along with a firewall rule if needed to protect our users.

Conclusion

WordPress 6.3.2 includes patches for 5 Medium-Severity vulnerabilities as well as hardening against separate Object Injection vulnerabilities found in third-party plugins and themes. Several of these vulnerabilities are trivial to exploit and we recommend updating immediately if your site has not yet automatically done so.

We have released firewall rules to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers against the most impactful vulnerabilities and these rules will be available to free Wordfence users in 30 days, on November 11th, 2023.

If you know someone who uses WordPress and isn’t keeping it automatically updated, we recommend sharing this advisory with them to ensure their site remains secure, as several of these vulnerabilities pose a significant risk.

For security researchers looking to disclose vulnerabilities responsibly and obtain a CVE ID, you can submit your findings to Wordfence Intelligence and potentially earn a spot on our leaderboard.

Special thanks to the security researchers who responsibly disclosed these vulnerabilities, as well as to Threat Intelligence Lead Chloe Chamberland for her assistance with this article and for writing the firewall rules to protect Wordfence customers.

WordPress Core 6.3.1 XSS / DoS / Arbitrary Shortcode Execution

Red Hat Security Advisory 2023-5693-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. These new packages include numerous enhancements, and bug fixes.

    The following data is constructed from data provided by Red Hat's json file at:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5693.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: Red Hat Ceph Storage 6.1 security, enhancement, and bug fix updateAdvisory ID:        RHSA-2023:5693-01Product:            Red Hat Ceph StorageAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:5693Issue date:         2023-10-12Revision:           01CVE Names:          CVE-2018-14041====================================================================Summary: An update is now available for Red Hat Ceph Storage 6.1 in the Red HatEcosystem Catalog.Description:Red Hat Ceph Storage is a scalable, open, software-defined storage platformthat combines the most stable version of the Ceph storage system with aCeph management platform, deployment utilities, and support services.These new packages include numerous enhancements, and bug fixes. Space precludes documenting all of these changes in this advisory.Users are directed to the Red Hat Ceph Storage Release Notes forinformation on the most significant of these changes:https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes/indexSolution:https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6https://access.redhat.com/articles/2789521https://access.redhat.com/articles/1548993CVEs:CVE-2018-14041References:https://access.redhat.com/security/updates/classification/#moderatehttps://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes/index

Red Hat Security Advisory 2023-5693-01

Red Hat Security Advisory 2023-5691-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Issues addressed include a denial of service vulnerability.

    The following data is constructed from data provided by Red Hat's json file at:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5691.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: bind security updateAdvisory ID:        RHSA-2023:5691-01Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:5691Issue date:         2023-10-12Revision:           01CVE Names:          CVE-2023-3341====================================================================Summary: An update for bind is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.Security Fix(es):* bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-3341References:https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5691-01

Red Hat Security Advisory 2023-5690-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Issues addressed include a denial of service vulnerability.

    The following data is constructed from data provided by Red Hat's json file at:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5690.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: bind security updateAdvisory ID:        RHSA-2023:5690-01Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:5690Issue date:         2023-10-12Revision:           01CVE Names:          CVE-2023-3341====================================================================Summary: An update for bind is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.Security Fix(es):* bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-3341References:https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5690-01

Red Hat Security Advisory 2023-5689-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Issues addressed include a denial of service vulnerability.

    The following data is constructed from data provided by Red Hat's json file at:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5689.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: bind security updateAdvisory ID:        RHSA-2023:5689-01Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:5689Issue date:         2023-10-12Revision:           01CVE Names:          CVE-2023-3341====================================================================Summary: An update for bind is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.Security Fix(es):* bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-3341References:https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5689-01

Red Hat Security Advisory 2023-5684-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include a null pointer vulnerability.

The following data is constructed from data provided by Red Hat's json file at:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5684.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: galera and mariadb security update  
Advisory ID:        RHSA-2023:5684-01  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:5684  
Issue date:         2023-10-12  
Revision:           01  
CVE Names:          CVE-2022-32081  
====================================================================

Summary: 

An update for galera and mariadb is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera  
(26.4.14), mariadb (10.5.22).

Security Fix(es):

* mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

* mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

* mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

* mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

* mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

* mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

* mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

* mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2022-32081

References:

https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5684-01

Red Hat Security Advisory 2023-5683-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include a null pointer vulnerability.

The following data is constructed from data provided by Red Hat's json file at:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5683.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: mariadb:10.5 security update  
Advisory ID:        RHSA-2023:5683-01  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:5683  
Issue date:         2023-10-12  
Revision:           01  
CVE Names:          CVE-2022-32081  
====================================================================

Summary: 

An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. 

The following packages have been upgraded to a later upstream version: galera  
(26.4.14), mariadb (10.5.22).

Security Fix(es):

* mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

* mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

* mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

* mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

* mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

* mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

* mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

* mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2022-32081

References:

https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5683-01

Debian Linux Security Advisory 5525-1 - Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix, which might result in denial of service, information disclosure or privilege escalation.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5525-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffOctober 11, 2023                      https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : sambaCVE ID         : CVE-2023-3961 CVE-2023-4091 CVE-2023-4154 CVE-2023-42669                 CVE-2023-42670Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,print, and login server for Unix, which might result in denial ofservice, information disclosure or privilege escalation.For the stable distribution (bookworm), these problems have been fixed inversion 2:4.17.12+dfsg-0+deb12u1.We recommend that you upgrade your samba packages.For the detailed security status of samba please refer toits security tracker page at:https://security-tracker.debian.org/tracker/sambaFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmUm5ZQACgkQEMKTtsN8TjbcbRAAqOaI9Jxx/E7BqJBYFkbXikQJp/EIGs79DXeeR/iPdElJVSPgEe6FdJh4rpQlYQM8cHq/satLr0/6nLLBAAEg8QKuibBI2qQXnHBKeY2U5NRjOo0IGDEJYfQXDxGtt/A11LGmx5tZTOMkMPtAr6wqwcVu0dBLNwD5V1FIV1iynoDwjxOVAYJSlpBhfwfwAF70SMByQI81+4L4oRqHQIfgrQEppguFBIrjJp038teTRaDA4KWwBATexdwiEwdyppYelMJX57BxW4TBIaEwup2LX37Dt+d52xD4NtTEX5+bauygZIFrV7KAFOi/3gMcCmFwHVe13vxCz8Idy+OQSUpAXUIHbi0bEr4w0ahF0N6+A5E/SC196X4/YL1xT+92RVviiRO6X5QZZ1ye6gPdlUiB+2shRtSkHL4ymYFvlhPEkDKSSHHzN+VVm05WyJD4vK+sfrgW5UPDoi+feuIVkr79n2VLJNhkl7RcphGMd2n6580UjpoIW65HrtwEYwxPJWJWq6w1tFj2D+PuIrNeGFAaBHy64slNym6aHNwiN8M2NpZm/5YnlFz5cS5PS1W3l8bLDwdH4jOzuiafQdVIiMF+sr3RSWklPSXZsWLjLj2RS1KYfuAtcgZPrTfeYuKGJkQ5xPeIvTni8MhTCNt6QDG8G+SU1y6vKDdegK25ih4No/w=OHBQ-----END PGP SIGNATURE-----

Debian Security Advisory 5525-1

Debian Linux Security Advisory 5524-1 - Kevin Backhouse discovered an out-of-bounds array access in Libcue, a library for parsing CD metadata, which could result in the execution of arbitrary code.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5524-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffOctober 11, 2023                      https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : libcueCVE ID         : CVE-2023-43641Kevin Backhouse discovered an out-of-bounds array access in Libcue, alibrary for parsing CD metadata, which could result in the execution ofarbitrary code.For the oldstable distribution (bullseye), this problem has been fixedin version 2.2.1-3+deb11u1.For the stable distribution (bookworm), this problem has been fixed inversion 2.2.1-4+deb12u1.We recommend that you upgrade your libcue packages.For the detailed security status of libcue please refer toits security tracker page at:https://security-tracker.debian.org/tracker/libcueFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmUm5a4ACgkQEMKTtsN8TjbTjQ//USLpGR9QpAIp6HVz5CUfOOYS3SabPbdNIxIxFj7B175rHH+7ZwFcu1Ox2D2AIS7jOEaMoD6H5ixmk01jG9pe1puF660Fx7f9tZkmyGhJMdHF6UmG76B/vGNmFZToXeIYFvQu54iGUSYgl99r8kQIeRPIF3AImgQnShVSSJDBBDgOqr0pWfMLoHiV5M2v2U4RQmpjw7IKXNr5gcS7mTt/Kyhba8x2WzPcG8SMew5/8/TRjxU1b+DH58EsFoJ1Ou9p2oFcYJpuEklcfilW04kEyDJ5JVyj8AOXkfuwECVehH4iOofAJdKcb/ZX2KvUdZZh+niWet59ZleJ4nvJedtAjJcFkLa9NEyfJewOkZB/FBq7vMNv+aVQqhRAREoFnA0mIRaupFSbS8wYCEDL9mavBFMv8nv/5mQ1AyDrC/pk3QcNf0qnOsJFPMAK/lBxC3775CWN0tIVFtBhxX8bsdquYQlBUzzG8cr3usLYvT1OwK07nVj+SDKRimTuGeRuBZGa08GZ7cjrlXvqLNBHWISaRgX7BjY53rDVKhg3qLJJ3xj9KneN2JJkkat8/xGXBpNkiU23D33YTFYA5CRXzAJO/T6MMHAzmqDIZ9e79oRG8WazOwUCLjCLfCghLY4brLsT86IwYCrlw9SxyfDXZelFO8xa+vkhUl/68os95udZ0NU=zzmh-----END PGP SIGNATURE-----

Source

Packet Storm