{"id":102350,"date":"2021-11-21T15:36:45","date_gmt":"2021-11-21T13:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim"},"modified":"2021-11-21T15:36:45","modified_gmt":"2021-11-21T13:36:45","slug":"uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim","title":{"rendered":"Vulnerabilities in LibreCAD, Ruby, TensorFlow, Mailman, and Vim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Several recently discovered vulnerabilities: <\/p>\n
\n
Three vulnerabilities in the open-source automated design system LibreCAD and the libdxfrw library that could trigger a controlled buffer overflow and potentially allow the execution of arbitrary code when opening specially crafted files in DWG and DXF formats. The issues have only been addressed in the form of patches (CVE-2021-21898, CVE-2021-21899, CVE-2021-21900).\n
A vulnerability (CVE-2021-41817) in the Date.parse method provided in the standard library of the Ruby language. Flaws in the regular expressions used to parse dates in the Date.parse method can be exploited to perform DoS attacks, leading to significant CPU resource consumption and memory exhaustion when processing specially crafted data.\n
A vulnerability in the TensorFlow machine learning platform (CVE-2021-41228) allows for the execution of arbitrary code when processing input provided by an attacker via the --input_examples parameter of the saved_model_cli utility. This issue arises from the use of external data when invoking code through the eval function. The problem has been resolved in releases TensorFlow 2.7.0, TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4.\n
A vulnerability (CVE-2021-43331) in the GNU Mailman mailing list management system, caused by improper handling of certain types of URLs. This issue allows for the execution of JavaScript code by specifying a specially crafted URL on the settings page. Another problem has also been identified in Mailman (CVE-2021-43332), allowing a user with moderator privileges to guess the administrator password. These issues have been fixed in the Mailman 2.1.36 release.\n
A series of vulnerabilities in the Vim text editor that could lead to buffer overflow and potentially allow an attacker to execute code by opening specially crafted files via the -S option (CVE-2021-3903, CVE-2021-3872, CVE-2021-3927, CVE-2021-3928, fixes \u2014 1, 2, 3, 4). <\/ul>\n